Malware Analysis Report

2024-08-06 09:37

Sample ID 230602-yq4qtseb79
Target ryuk.bin.zip
SHA256 d107f2cbd1a749f79abe402eef3f71d3c0fceca69f4692908be091f044220842
Tags
ryuk discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d107f2cbd1a749f79abe402eef3f71d3c0fceca69f4692908be091f044220842

Threat Level: Known bad

The file ryuk.bin.zip was found to be: Known bad.

Malicious Activity Summary

ryuk discovery persistence ransomware

Ryuk

Deletes shadow copies

Renames multiple (5421) files with added filename extension

Loads dropped DLL

Executes dropped EXE

Modifies file permissions

Adds Run key to start application

Drops file in Program Files directory

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Interacts with shadow copies

Runs net.exe

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

MITRE ATT&CK Matrix V6

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Registry Run Keys / Startup Folder
T1060
Privilege Escalation
TA0004
Defense Evasion
TA0005
File Deletion
T1107
File Permissions Modification
T1222
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490

Analysis: static1

Detonation Overview

Reported

2023-06-02 20:00

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-06-02 20:00

Reported

2023-06-02 20:03

Platform

win7-20230220-en

Max time kernel

155s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ryuk.exe"

Signatures

Ryuk

ransomware ryuk

Deletes shadow copies

ransomware

Renames multiple (5421) files with added filename extension

ransomware

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\noaRPxNdrlan.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HqGqtOqQllan.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Windows\system32\StikyNot.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run\RESTART_STICKY_NOTES = "C:\\Windows\\system32\\StikyNot.exe" C:\Windows\system32\StikyNot.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0313970.JPG C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0293828.WMF C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\picturePuzzle.js C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Windows Mail\it-IT\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfxrt.jar C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer_3.2.200.v20140827-1444.jar C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\MSB1FRAR.ITS C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15275_.GIF C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kabul C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\RemovePush.sys C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\clock.css C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01239_.GIF C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_de.properties C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\highDpiImageSwap.js C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Mahjong\ja-JP\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\settings.html C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\PREVIEW.GIF C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01170_.WMF C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-awt.jar C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_ja.jar C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Taipei C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_bkg.png C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0292248.WMF C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Origin.xml C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287645.JPG C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01236_.WMF C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY01462_.WMF C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18227_.WMF C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Beirut C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Maldives C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\dumpmeta.luac C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ACTIP10.HLP C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\COPYRIGHT C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00455_.WMF C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01237_.GIF C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Christmas C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server.jar C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\sl\RyukReadMe.html C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00998_.WMF C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Singapore C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Cape_Verde C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\currency.js C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.html C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaSansDemiBold.ttf C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Pontianak C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.png C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\calendar.js C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\settings.js C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18209_.WMF C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\MINIE C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{56CE8201-0180-11EE-A3F6-D6914D53598A} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{56CE8203-0180-11EE-A3F6-D6914D53598A}.dat = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache C:\Windows\system32\rundll32.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\HqGqtOqQllan.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\noaRPxNdrlan.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1900 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Users\Admin\AppData\Local\Temp\noaRPxNdrlan.exe
PID 1900 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Users\Admin\AppData\Local\Temp\noaRPxNdrlan.exe
PID 1900 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Users\Admin\AppData\Local\Temp\noaRPxNdrlan.exe
PID 1900 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Users\Admin\AppData\Local\Temp\noaRPxNdrlan.exe
PID 1900 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Users\Admin\AppData\Local\Temp\noaRPxNdrlan.exe
PID 1900 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Users\Admin\AppData\Local\Temp\noaRPxNdrlan.exe
PID 1900 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Users\Admin\AppData\Local\Temp\noaRPxNdrlan.exe
PID 1900 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Users\Admin\AppData\Local\Temp\HqGqtOqQllan.exe
PID 1900 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Users\Admin\AppData\Local\Temp\HqGqtOqQllan.exe
PID 1900 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Users\Admin\AppData\Local\Temp\HqGqtOqQllan.exe
PID 1900 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Users\Admin\AppData\Local\Temp\HqGqtOqQllan.exe
PID 1900 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Users\Admin\AppData\Local\Temp\HqGqtOqQllan.exe
PID 1900 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Users\Admin\AppData\Local\Temp\HqGqtOqQllan.exe
PID 1900 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Users\Admin\AppData\Local\Temp\HqGqtOqQllan.exe
PID 1900 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\net.exe
PID 1900 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\net.exe
PID 1900 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\net.exe
PID 1900 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\net.exe
PID 796 wrote to memory of 860 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 796 wrote to memory of 860 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 796 wrote to memory of 860 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 796 wrote to memory of 860 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1900 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\net.exe
PID 1900 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\net.exe
PID 1900 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\net.exe
PID 1900 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\net.exe
PID 1748 wrote to memory of 1220 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1748 wrote to memory of 1220 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1748 wrote to memory of 1220 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1748 wrote to memory of 1220 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1900 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\icacls.exe
PID 1900 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\icacls.exe
PID 1900 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\icacls.exe
PID 1900 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\icacls.exe
PID 1900 wrote to memory of 284 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\icacls.exe
PID 1900 wrote to memory of 284 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\icacls.exe
PID 1900 wrote to memory of 284 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\icacls.exe
PID 1900 wrote to memory of 284 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\icacls.exe
PID 1812 wrote to memory of 1892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1812 wrote to memory of 1892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1812 wrote to memory of 1892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1812 wrote to memory of 1892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 468 wrote to memory of 1828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 468 wrote to memory of 1828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 468 wrote to memory of 1828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 468 wrote to memory of 1828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1900 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\net.exe
PID 1900 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\ryuk.exe C:\Windows\SysWOW64\net.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\ryuk.exe"

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x1b0

C:\Users\Admin\AppData\Local\Temp\noaRPxNdrlan.exe

"C:\Users\Admin\AppData\Local\Temp\noaRPxNdrlan.exe" 8 LAN

C:\Windows\system32\StikyNot.exe

"C:\Windows\system32\StikyNot.exe"

C:\Users\Admin\AppData\Local\Temp\HqGqtOqQllan.exe

"C:\Users\Admin\AppData\Local\Temp\HqGqtOqQllan.exe" 8 LAN

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\cmd.exe

cmd /c "WMIC.exe shadowcopy delete"

C:\Windows\SysWOW64\cmd.exe

cmd /c "vssadmin.exe Delete Shadows /all /quiet"

C:\Windows\SysWOW64\cmd.exe

cmd /c "bcdedit /set {default} recoveryenabled No & bcdedit /set {default}"

C:\Windows\SysWOW64\cmd.exe

cmd /c "bootstatuspolicy ignoreallfailures"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\*" /grant Everyone:F /T /C /Qÿÿÿÿ

C:\Windows\SysWOW64\icacls.exe

icacls "D:\*" /grant Everyone:F /T /C /Qÿÿÿÿ

C:\Windows\SysWOW64\vssadmin.exe

vssadmin.exe Delete Shadows /all /quiet

C:\Windows\SysWOW64\Wbem\WMIC.exe

WMIC.exe shadowcopy delete

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\NewHide.potx.RYK

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RyukReadMe.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:25536 CREDAT:275457 /prefetch:2

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

Network

Country Destination Domain Proto
N/A 10.127.0.1:7 udp
FI 65.108.73.108:7 udp
N/A 10.127.0.1:7 udp
N/A 224.0.0.22:7 udp
FI 65.108.73.108:7 udp
N/A 224.0.0.252:7 udp
N/A 224.0.0.22:7 udp
N/A 239.255.255.250:7 udp
N/A 224.0.0.252:7 udp
N/A 239.255.255.250:7 udp

Files

memory/1900-57-0x0000000035000000-0x0000000035162000-memory.dmp

memory/1900-59-0x0000000000570000-0x00000000005A7000-memory.dmp

memory/1900-60-0x0000000035000000-0x0000000035162000-memory.dmp

\Users\Admin\AppData\Local\Temp\noaRPxNdrlan.exe

MD5 987336d00fdbec3bcdb95b078f7de46f
SHA1 8bbded5710280f055bf53f9e4f6c5abb596f7899
SHA256 a9643eb83d509ad4eac20a2a89d8571f8d781979ad078e89f5b75b4bcb16f65e
SHA512 39edeaa6ec301af43886748b588dd554c5f06d9dabbaf9aa6595a216111fe2923ba8c48e177f0a9ff2b865923d1051005299946765fc303c409419d7eca6e2a3

C:\Users\Admin\AppData\Local\Temp\noaRPxNdrlan.exe

MD5 987336d00fdbec3bcdb95b078f7de46f
SHA1 8bbded5710280f055bf53f9e4f6c5abb596f7899
SHA256 a9643eb83d509ad4eac20a2a89d8571f8d781979ad078e89f5b75b4bcb16f65e
SHA512 39edeaa6ec301af43886748b588dd554c5f06d9dabbaf9aa6595a216111fe2923ba8c48e177f0a9ff2b865923d1051005299946765fc303c409419d7eca6e2a3

C:\Users\Admin\AppData\Local\Temp\noaRPxNdrlan.exe

MD5 987336d00fdbec3bcdb95b078f7de46f
SHA1 8bbded5710280f055bf53f9e4f6c5abb596f7899
SHA256 a9643eb83d509ad4eac20a2a89d8571f8d781979ad078e89f5b75b4bcb16f65e
SHA512 39edeaa6ec301af43886748b588dd554c5f06d9dabbaf9aa6595a216111fe2923ba8c48e177f0a9ff2b865923d1051005299946765fc303c409419d7eca6e2a3

memory/1900-71-0x0000000035000000-0x0000000035162000-memory.dmp

memory/1536-74-0x0000000002370000-0x0000000002371000-memory.dmp

\Users\Admin\AppData\Local\Temp\HqGqtOqQllan.exe

MD5 987336d00fdbec3bcdb95b078f7de46f
SHA1 8bbded5710280f055bf53f9e4f6c5abb596f7899
SHA256 a9643eb83d509ad4eac20a2a89d8571f8d781979ad078e89f5b75b4bcb16f65e
SHA512 39edeaa6ec301af43886748b588dd554c5f06d9dabbaf9aa6595a216111fe2923ba8c48e177f0a9ff2b865923d1051005299946765fc303c409419d7eca6e2a3

C:\Users\Admin\AppData\Local\Temp\HqGqtOqQllan.exe

MD5 987336d00fdbec3bcdb95b078f7de46f
SHA1 8bbded5710280f055bf53f9e4f6c5abb596f7899
SHA256 a9643eb83d509ad4eac20a2a89d8571f8d781979ad078e89f5b75b4bcb16f65e
SHA512 39edeaa6ec301af43886748b588dd554c5f06d9dabbaf9aa6595a216111fe2923ba8c48e177f0a9ff2b865923d1051005299946765fc303c409419d7eca6e2a3

memory/1900-85-0x0000000035000000-0x0000000035162000-memory.dmp

C:\$Recycle.Bin\RyukReadMe.html

MD5 74b63ae5ae7651c3e568c0008e8e8115
SHA1 f0cb2c445e2a04bbf972b0a12106501250929282
SHA256 9d02b65535798947514ce2d4191de4e3789036a05e8b4bdfe87bf5957de8afa3
SHA512 26cc7759eeee635cc700ab0b075912bc27b92defe286b1b631fde70f30c64b4433ff1af386e08c3ccce57de404e47219b714b6bec89e36999a883397eae45f73

C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst.RYK

MD5 7c50e9df6edbe73dea54433e9706f043
SHA1 5151bc38ca287e8f2bdcce5faacccb0b0bca73ab
SHA256 8d17e3190774b01214f7aae14e1e8c05a8a7925315f1fd73b2b402f3a74739ae
SHA512 bd520a9ea7357dd0a12654073524f91a5b699e8e822c83d487ae790d8a885ad64f8ffc5c20cb84f2dba71183f46ab1ece3ba669a86531bc2384d26e319a8b6e8

C:\Users\Admin\AppData\Local\Temp\ASPNETSetup_00000.log.RYK

MD5 8532342c220281f4c5ee87357d62662c
SHA1 a379f9d55e9955263ea8d45de2be041cf707b6a2
SHA256 2a027ae4a9bcec919671370bb583d6ceea20a628d6b658af676fa71286663151
SHA512 636475796bbf31de6914f99554e4189fb6dde4f2cd3f8f58b4b8d75a9b546053150320df4c4205324a0e444673d02ece310d8bf0e6121b0aa71fb990a8b2c487

C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI1374.txt.RYK

MD5 db19e4efe75872982eaf3a04fedb85a5
SHA1 55696b2b429bab3edab296c720ce5c8db6498bdf
SHA256 bd9596329a264d51eeddbd703f34a5ea4697f3ffb7bdf751c17fa1a031507717
SHA512 b0a43d52e94508e85dd9e3da1b996c3b193e94ad8ec4fa00f9e066fa09a873d286b4c574905e33d928e8dec940de188151bf7cd1c7ce459e6e4b87c1a4bbfe40

C:\Users\Admin\AppData\Local\Temp\chrome_installer.log.RYK

MD5 0682fc7289de57862b46c7b8cb6c0baf
SHA1 fd4e129c1d6e36327b5bd43255638b18f849b542
SHA256 c456338f94894172cf17d661f7857136752222f7ad785a2fb9f663e04b9a6796
SHA512 fe855ff2fe93a31a2b9722c95c7aed7d84d99f3bc487adb3d5c5e7dc4838215667996309b2aa8113b41f57c75d70a0d1825f23e60b915fbcee12d3f69cf637b4

C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI13CF.txt.RYK

MD5 f06d75e355179496108417a95bf9fde7
SHA1 a9f2468ccbd2293ff0537ce96311f810b2b70e53
SHA256 4b687e1d3a2554d093ab8db88fdd84f8dcf719bf685812021a45615f128502f5
SHA512 02c9e7e155b030169c552f4d21da53af8f9d5d4c2979431d7533f68c3ff02b027f8476ab614af35c75ce5ae6912864d26f2424362ba80d5ae9b90fec75ec6ee5

C:\Users\Admin\AppData\Local\Temp\dd_SetupUtility.txt.RYK

MD5 25f434a22f5b9513addf8c31601c8b4b
SHA1 abc5c34206b049c7943e4cf44bd6ba74b6c3f567
SHA256 4e827460eb198601b03d3e9aef65e89c43d5f63abc12951dd693df42370115de
SHA512 16392e0493186462ed9b9b47cb2ebfc60fbc5532ff9b6dd41619c53ec77b585c52622990633695eb21cb7c5fac869b1ed6cfa060ed30192a9bf68e8d1ae85328

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.RYK

MD5 47f050a89968a0392042d2ef50a5f49c
SHA1 df0122a956a0bc8de313e9011c1bff86d056a6db
SHA256 4db59b2286403fbbde80fd6ee57878567df3209635108620fe0c054e679688c5
SHA512 7143e3d164a8ba0ff4963d11f1370081246fe294c04ac0e99724d5494c2212e0e551381869b06ec62feb9b222b9e16f2214368cb1dee40167e84a5b249f9232c

C:\Users\Admin\AppData\Local\Temp\java_install.log.RYK

MD5 3ee9b10b3ad5886b9500e0b5f1318350
SHA1 33d8093582b509689a7aa41f22840147cdd87209
SHA256 93316def7c9712ccf2f73fc412ea6f6f1c1adc78964a6854ae2f39faf536d2e7
SHA512 9250bd95c112878efad946bf094cf554243fe22469ee195c4d511964770b14074f96d0e914658ea7f932a65488c26800dc4ed4dbd58c62441c3540d9e92b48f3

C:\Users\Admin\AppData\Local\Temp\Admin.bmp.RYK

MD5 fabadd464dc525c8fbffa392811466f6
SHA1 9523e76d927e2a3a703ee53d03e31cdf1b6a40bb
SHA256 49bc0977792db355ffc1fb7e57e8865d49d22c555ef7f7bd4f7a0c26fb5a4fee
SHA512 253fd3a3da3a06a2103d4ae7b4b6996e28f515c5c40abe5a35ddb6742e3a7da1254df5c80d392a0274612d06e966a689ddc4afd264ae96ff95d2ad1e6048bcef

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD.RYK

MD5 9aa5af0f0ae7daa02fa5fd5bc9a5df03
SHA1 424cd0f2ac732d58ed3a157c5cb74a3c597cbd27
SHA256 f84f0b7a461282beec59806202053393e2b0f7624ef609879ccf11d4a589924d
SHA512 209b967dc2e4ec181dd8bfdfda812ea522e3b9c17cbe595643a113e26c5ed86cf4028cce32bbc359ba4fbf0be91b30fdb92841bad5747c2a7e8393554e02c94e

C:\Users\Admin\AppData\Local\Temp\jusched.log.RYK

MD5 034d9901a48abfd7c4c6ee4eed2364df
SHA1 45557ae4f9b8462e844faa95ec9292c6c992be1e
SHA256 c0880758d1caf9f074cc06354b0295214edc650d86441e930c246e93110a40ab
SHA512 6c83833ce8773310377001567e5dd6200e69feeb94bee6ef1c31eacc931849ed479b9438978daa8d90308348e27e6b1452bd4d731e9e204c53a8f69a2a059dea

C:\Users\Admin\AppData\Local\Temp\RGIA8DD.tmp-tmp.RYK

MD5 a5ab6ae0177ae07697515d705a759e70
SHA1 36bd0a59d9199875202a93e26c51371219607dd4
SHA256 79894477e3f64f4bd1b1d63042a936c471ade82e6e9cdce1afb6c6678135bee3
SHA512 4f227cc6653b56075a18d8ecd70a6f0b4ebc1b3fbee4c4b6e9f03cf54666ac2c2d52b88f82bee4edd0693bef3537fe3bd65b6be8b333cdcee0ec5f3411590951

C:\Users\Admin\AppData\Local\Temp\dd_wcf_CA_smci_20230220_230001_278.txt.RYK

MD5 2cf5850f4b5a0392ee243511f3bf542b
SHA1 ad8bdfcb01950e86a4c45f7a1d5293f3687d1714
SHA256 57f252f5bc7f34538c1139688156d4396843179821a92c8968281a16fa37f147
SHA512 7074573dfdfdcff035ef7e4bc6a595d36d2219830672b46a7c6b5506e0d9438d4850783050ccde4e949f270908260ed4bd3835267e40e4b6cc92dc4fb13dda9e

C:\Users\Admin\AppData\Local\Temp\ASPNETSetup_00001.log.RYK

MD5 1b47207a21d6be09aa18756112c32666
SHA1 0033bb819512bdf7e89b8f41bb1b8b2c837895a4
SHA256 817c39d8933e2dd1c23e8932c55695e7b671927e0afcc11f6a88918cd8ed6e6c
SHA512 536b35c15173b1ce3d54daa1708c6f26a0abf30c37318b00a7aa22b431808b56171d0371c2f611a76dd5d2eda120cb729466ee7e8614243d44e07124a1bf80bb

C:\Users\Admin\AppData\Local\Temp\dd_wcf_CA_smci_20230220_225958_751.txt.RYK

MD5 1dca9c6891dae07918f7427b2992a974
SHA1 54a6d675da745322559cde27f0d86651463ac184
SHA256 dc4989a5132a833bab0bdb965688d24798b035801e7824f4c52a29aaa1270c61
SHA512 9da4e5d9bed71dba7e64a7fff1f1d8825d4661ee0aacdc4f342d6e27aae048c4f020697d6879af8844577ff149614574f87d8486022f5e2307e1d9a9840966b5

C:\Users\Admin\AppData\Local\Temp\java_install_reg.log.RYK

MD5 a5d2fa79853c468b76f187ed59b40dbb
SHA1 b03b529293b5a2a72f400ed62c8a0e29203452e9
SHA256 ad84c1f3871d3118a56a842481e28a953cce4c155b611c20b335b07c04cbdc0d
SHA512 92c477bfa41e3127cdef58d5063aab879366efb4f6ee2fff2359047db171c9f2d5b40b35cf1ec6c9682d8be0270cf4d3716d8278f76cd5b1d8b64bb5dae611e7

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Monet.jpg.RYK

MD5 21560d25eab7d58a8b16ae02ce222813
SHA1 afd8a6dc4b9b4c1b108707bb7ba4ee3fc46ffe0f
SHA256 9f458f9ccb22b6b1043437b1aae8a7f0f9cbc61c4fcaa4014dcee3e76306d85a
SHA512 7f2d625186aa66c7bf6ceb907d716b83f6c9d582e03e8576e180f397cb773044a8c244a5cb8be5dc0ea9cb3065dfd270f71967b1ac818ccd20028fa90d52abb6

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.htm.RYK

MD5 dd916c47ce9fc1cd648791d704c779da
SHA1 3ec80afded18555d3a1a719dcbfee6a51c1d9d2e
SHA256 63164253240f21d6d890c625b0518c0af0d3e61c53c75df0a24631e3b86c9840
SHA512 f3a9eb3550a8685da57f50e14b2a5dbf6d54cd68f3aa24904aa5c1de411aa5a4e8d2b7603a8c9fd2fc758f3a8bd54642aa3f6c85f8065eb13c13666583bbbade

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.htm.RYK

MD5 5c71f7b02d133216e94c4026a18e247a
SHA1 4f7351e4aa7a1caab69a2e7d68e43e7e69599679
SHA256 28321a97f9f64df8d232b431060e4123a0a0287db509d72048ec4ef35419f854
SHA512 51d9228ee49b904b2fdd5cc3356b2eb0815a9d00aa3c3cd1297dd23a5d33b65eca01ab13b26c8ee80e55d20096a5ac940608406daaf5977991f06dc264a5a842

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.jpg.RYK

MD5 e07a7307cbc8f10a8b084e25daf4d00b
SHA1 a177f15b974e72effabfee64a72b5d9f9a1b1f1d
SHA256 500ccba91b97eaf8892f0bd8dc64c0ec7921c8c51ddfbba0088bc63347ee2599
SHA512 9a53caabefe63255ba2f0163de60a518ceb69da6b099e63e45430fb51d68f874bec702c0c487526238c3dc67551d34bd17f62582406e1079e59ff23e8ad329d3

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Tiki.gif.RYK

MD5 3051b53495e8e0512d90e9222566eec0
SHA1 4765a03195bd4762968f7dbdfd25d113d0b29b8d
SHA256 d4e3356c702e13654c4db4af9a58227874d510ca6e8d6fa1ecb3e4d173ffa9e5
SHA512 52df8207e6c84dd132f1a20e8ba7b0d5e38d3aea43f3e655b65536c894146b6463594e98a7eac99949ea355e2875774bc9b7a31fba3e2b54231093a948ab3d41

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Music.emf.RYK

MD5 069c84bce202211920cbd18204c4c7de
SHA1 057776687f027c0125fae481f804af23504a4bbc
SHA256 a2cf9ab7f8bbf92b6b86d1a798af6c2091020a2e75ae8dc1e30939257ee61c28
SHA512 b978740b3d30939f88206056521587c462ada2d61a4b9a86426abf287017279c8df7b41baa39a8e13958d25d41f8370e51a678174bf574ca78a6a5cc41dc975d

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.jpg.RYK

MD5 f3a8b0c14331f1227809ca10af581cf9
SHA1 179d78c00175cc72fb1a040b7f49f0bca6c8aabb
SHA256 1c7c8c1aab59a6f13ed3bef6b8e14d1882d0967d56d4355ab2366218c1cf2141
SHA512 62d789c04cd38c8af77dde2e62895528f3304b9eac8bcd4fb8b79a1c92d98656d8219990e46f1b87c0f4ea587171aa1d1988d39997bba5eeb8ebe2039029589e

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Seyes.emf.RYK

MD5 73d33136dd7d81ee2ebcebff6e2f41e2
SHA1 7214a515e84da9051e6f2aec18f810cb8b762181
SHA256 f7938eda49a2ba8259388a11af1d6838a3612d3fc0f67fd5cd7942f0f9067f92
SHA512 8be8c63da5ca58ef14163bdcb0e6d92f37f215fd3153865ee41bc4b50e3600e3a58ef812cb77ffae1570fbe3e00555b5170c16279ba356905595656e3eea7a60

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.jpg.RYK

MD5 779b38ed19c7bc1859458c90851300a6
SHA1 fb8106c77fd9aee6f37f75e62eaf995f85e1ac3d
SHA256 e8463b83f09a983c2828c7c622a7ad0c1c8eaead73987074997339f643ee5337
SHA512 5b3ac44882676ec2aa19d7799a5ddf81145ab7810180f6c026401f6a4343f5fb047274d0014ef2a6bb1c3b2f3658c131a53db194dc856753825881651a549741

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.htm.RYK

MD5 1c256f01285b771f37b5adc88069abb7
SHA1 447618068eaabc229fa482687b7de5f725770f4f
SHA256 40c89b238e7fe08aa73a3a24496278bf5fbf8aaf2d3f395a3e78e2da61809d1e
SHA512 ba2d95fecbddb2636096a038773bfda81f8806d6719a0ac389ac9b4ed653c3fe4171999a277758c0d9e774b364dee27afb23377053c1964ccb0a91d98f93de8b

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Memo.emf.RYK

MD5 489ded84f8fbbb212bf9c1beedd8a1e8
SHA1 c1f4b1c26f3d5e29c5fd2e517fbc47a524d74806
SHA256 d9a09dbfb12df429bffb38ea7898e760ab9195ff3d6b511691d894e95c44783e
SHA512 17e341bbb94824a35e8600b0b5b3c934e9645ffc851c20a81c357333f6b0fda818296f9ffb5fe169d81142d682c81be9f5c675479799d5987032145befd20762

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Graph.emf.RYK

MD5 ce3d2daf69201f61e5b84ee841dd8cd2
SHA1 6bf5c114a5538e6d0f0c72713ef25ea4cb32b4c5
SHA256 fe4bbdfcbda607be7ed3f00ac49d6fa9d921dba0b511355062c8d1a6d29c2311
SHA512 70141805f97ba5c91d83c7839af1da28c3ecd9abb10564c90011d10ea889e3079d510a5cb27449b36d2648a8e055028f5a4a059108c75ef2b776367ba1ffac16

C:\Users\Admin\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms.RYK

MD5 e7764e6c23d1d8254f8c1d382802439b
SHA1 35b819266df6174abcd57c9387a88183aa1e212d
SHA256 b1f3184ec82146533637d1fd8bd37721223412600e18a4eed68d8de7adf7a40f
SHA512 5a304115e7fbab21406a8aa991888fd41a41a1b370fe1a96ea3298f2cf60b3b21128229a5a14cce762326a957b942c8450151bbf4f17b5cf5c0c8345605d2d48

C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms.RYK

MD5 dcfc3d6cebab8b1488492f74a338cb97
SHA1 f1ec8eaf5eada0335560838df6ae9b7713630d0d
SHA256 975af3fc229077ac1eb80bea1e8e1f6f048fba7fabda9cd753e24efbccab2e06
SHA512 3974df916a102e955658c9976f6c5090b098c2905c8c890f28687fc1711b238a876a54c15cd28e00f47061664cb82b83604fca449e4781106f50d956c6772340

C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms.RYK

MD5 96b86f3696814684b57608964fd5a221
SHA1 02e62105e866b68cb317bbf30c8d0263bb1b2549
SHA256 8872235aaa1d3098cfcdef7116662496db2ded7cc3cb5d0286233e47e8e70b24
SHA512 35b648a96b1472eacd390e1ce97c50febe482253ae56bd5343804e981e79ef05531b4c0bc5f59e91dbf8b87d628d5f1357ed9f65922e772b3e8dd61d61fdbbf8

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.bak.RYK

MD5 957c773c1c38e4c478dbf6361752f8c6
SHA1 9eea9df9c6878aac79c7312bfda9b38a116099d4
SHA256 d8b31a70905ec0063c03f4f39bf69af5cbd661de7f1331a35e91fe6e8c81cc1c
SHA512 fa667170bd437fd40f021cf8b590f8b7e9d12e0d9a6ba1352a48a1411821d8c6086139c8668ecbac07d945a324f6ff52e083d9ddc987a61ab24b6143a1504efd

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.RYK

MD5 f10eba03f49b6ea6543901351b15820f
SHA1 c619407a4cc936cbf8792aba15b4f65517049c35
SHA256 1b9abd36423d21a3852a7087c63ba59640c5b828021e4e3b08dd2fcbc55d90f4
SHA512 f31fdd0abedfe8890580472cc1bb735b9abcdf6fef83b020aa4a11c3096e359bda285ab42510fb113d0b81aeac482a626a324b36bab0739fb50bda4a03a091fd

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.RYK

MD5 38f2273cd36c600ffec33d78169b9e2e
SHA1 1100bde856beead88bbf3a648dc50ec9b3e9f602
SHA256 7d795b07722dadc30a6404c9e38404572b7b357f3246a64834606b06902ab378
SHA512 f818388256f160ef3781ca1559aa82124095130d6f31034a9f3a68f91e749d9ec07ce74a76c99c56f6b4360e2be24b1af0885312184eea5aca40ef7641a2b6e9

C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb.RYK

MD5 1c3e8af378fbd06697357d8017766f89
SHA1 546361d43b9eef522a4fbf84be9689d75a285573
SHA256 eeab6db9d06244da277233115025c3364d3b11b0d71b7b4762dcc1811bba2a65
SHA512 b7f49c0557850c2999ed4a827573b23151ff6d86cbed7546c5cc4ea76a6dc90142eef70ef9251f92e35dac9c306dce7de01da53c8843578d8d2516d88f8dfe32

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb.chk.RYK

MD5 0ba912aa72ec80f66e1aeef2a2dcfe57
SHA1 5b984e4778fef8a695e618031f99af2b141b95e8
SHA256 2c075c89b8022627fd4d5013bf0a35f8511824ceb8e97d08d956b1400a156bda
SHA512 7a853a9834f0675db490a17a4681c4a15e3b1eb46e8736f7661ddaf182a253005f9359c76105c9766783c3d6f82f5e665eb1b5303e08337225496b5264e78497

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edbres00001.jrs.RYK

MD5 ccacd8acc46ee81e8993d37c98ee4de4
SHA1 cdd367c3b22b1070a9a962602674f934dfe3bd26
SHA256 87f6a18e7b6be77885b60bdaaef00106244c707a28da8c61ab19571ed1477e06
SHA512 d4a37aa04fb210f6a45d452d3c8f5c7eaa8f35437129d7a554808593cf01b9b442731595099fc52c5f248d0b9fc6277e87bf7c1498f5abd3bc80195c078f4a3c

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb.log.RYK

MD5 6893df8f90f5af5bc6165b4fdc7ed0a4
SHA1 e4624090c823289f668dc8e42bdafa26ffd795a4
SHA256 698dcd1ce223a4d6c9333c897cb03f087e7b40407f3b8d75d4e8a61a67804a12
SHA512 c4559c340c79e3d2cc5f1608fb729b7a1d385e1c63a22d4b40e7b9235c8d948a69784cbaf6b02f59ed47a7364de2370e11ffba82a61c76f6f17fc7879bd8481f

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\new\WindowsMail.MSMessageStore.RYK

MD5 e1dc826ea01f1a8df6ca6a5ac763c635
SHA1 6462ffaf51aaa6e354d2a2c1f085a498da47912f
SHA256 3ec52f7785689bd0d0aba2a7e700149b41e7852bd8ac5a0f101c1b65d2000528
SHA512 25e4246ef2d0a8c3e9b4b87cc46de6e1e8dfd6057c3ae955f3304d83e0f700a8f891a4ded8eea465f287c6fd4e81f5bcae095ef11be1ea4cb4712d0f80d76252

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\oeold.xml.RYK

MD5 5baaabd54e762ccc7e1179da15d2f18e
SHA1 9279ce146c0dfc771c32f9e60118c8929e6539cb
SHA256 a9cce1d93db27bfa7daa7d6089343c44a21bf903821b481d24c27105d22f0b53
SHA512 fa696fa6f9856ad217924e021d1fc436b1a61c8bcbecd817c8362b6ed889a3ea973f5e1c1fc83685b1ba328a0d9b2649ba611863d1ad7769b9df3c68d44326c3

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edbres00002.jrs.RYK

MD5 c5d242ba34648b01f62da1c435dc38ec
SHA1 c625d85b888b8511db44de0abd023baf5db2f27e
SHA256 b73f4699b522000de72353e75705cdba0a0f83055ee30f6eb6805533eafde96b
SHA512 4a46ac4ec74dfc433a0f0699837706c50de9adde9acb64b0db71f562e0df21a57613b520cb33ab0f864f8b4c34d70d0d88060d7dbdbfe808d873cd7d7ab8e9df

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb00001.log.RYK

MD5 f22f0084d3211c0bb9cd6ce984882495
SHA1 cab6925c1422ecc3f55b6b34bd934564e0e5cdab
SHA256 e3dbdb58cb01af9d33907c2868912c3b04861280ffdc6d78a86a153f9761523d
SHA512 b599a9f6127c9db47484054bb18f202dc9a1c9116d1646dcb7e16961159a85540da6e297d23829d7c757636b54bc5db7483941856544b738e5bfd01d7f39c1ac

C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI1374.txt.RYK

MD5 3084519a3011fa0489b9ff5aa12391df
SHA1 64a4048d003fa0cb31bab4cf42deb9a811937ad5
SHA256 c9d08f969a3672a7c8cd57b69e8b5aed99e6e37d7635e508cc2a130cfd5d9a7d
SHA512 e93c5d852dd6dad6903b9ff9e48f0fd73c16d71c42a90dfffb70d0edb93a0ad6f969e9006acf90e2a91ebfd3c69a59764fbe14c0893226ff9e8f11e2cdd146ff

C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log.RYK

MD5 e5148a1480fc8f05c420b766f4bda73a
SHA1 9fec14c2753dc0b4e1f2baa68bd2b863a67a2d6f
SHA256 ffc346c80f7cbd35fc005cdcdfb008d0b3641539ec496227518b4bece6eaa222
SHA512 0b27f397a889a6b6106dd56d2111e18c32dabde14c4cabd17e41995d610368f253004beae17bc5bae1b91b81d7160df76cb3c5d8d52d24829c2a89c1c5852165

C:\Users\Admin\AppData\Local\Temp\3465694049\payload.dat.RYK

MD5 0850b3d9e5717403bf36879c18d6df52
SHA1 51b141d74d0f7988c98d2bd15813fdb601475c92
SHA256 86da47aedf0389d3d0b749f33f48a1b0dfc6f2a3ac44b58e3b3a6cf4500fc5f7
SHA512 f33be842d630b83f9b56885bb213d5907a8314489a909f372d6f08f4cd231561959ab2ae585dcef1c82e80a2007b5488bdeca3343b551374d5b36a3273a3ef38

C:\Users\Admin\AppData\Local\Temp\wmsetup.log.RYK

MD5 e51db6ff7809842901014a38f1e24173
SHA1 3070e825ff99413cbc472a2e12274c3f5e841140
SHA256 4d93424272396fa99d156ed41c1ea4117b38e0632300fef4b7f01407a7110551
SHA512 bde5b6689c635e5a90a3892115924dc25fab871dd33ad0e74a9ec4d5e4dfd3daf768031a5c47b05d8703693cb3e2b945d4d089413d1dca5b8c1b028f0fb485b1

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ONXID7T\favicon[1].ico.RYK

MD5 d2571d94304ef50db90a7a74dbc4d97c
SHA1 3c55c2cf6910487206acefd745d3cf1b18d4c75f
SHA256 8b3eb4d4b70cbca0c12f1cef78f20e1104ac4cf53be3f7d5e5dad2a93f997e7f
SHA512 e4202fab0dad4929ef3746a478af6738e33f43b8e54eda8cd7a90fdfe776e3e6ce1b66702f0910f879906fe0c3e0138f98fbbdd377032be0ce080ed34ec4a82b

C:\Users\Admin\AppData\Local\Temp\RGIA8DD.tmp.RYK

MD5 5c5c420a09fdcb97455b3570afe1a852
SHA1 5c1b0359515f773c4521ad59fa758b2076876f28
SHA256 fc7df1c0488fe8feecfb3d85504efe840f480b46f8a2b76e5efb5ce47b8c9ad3
SHA512 b9bf44013f17423d00bc88e01ec81c52102f8b76df87b34a4febe1d9477d90152e5b6873b62aae79b1d43211655500688748bb3def2af13d8d9ac985f7e3f731

C:\Users\Admin\AppData\Local\Temp\lpksetup-20230220-232041-0.log.RYK

MD5 fb8f907cc4b3a5dcb099319db85366af
SHA1 8fdc0c0e5ee427d64515afe9a146be1b12b65743
SHA256 b38a80b8e5aa10cf2aeff03de88248b3a36fdbbd39442c00b6e36a9f1bb41ede
SHA512 2fa60eaba2c7da71957883767dae39b9e04694c431f66c21b54392b8f7f8a5213363e169cf89b65e12c711a2c81263d7d0dc332bc7b7ec32c6dd248cd714fc69

C:\Users\Admin\AppData\Local\Temp\lpksetup-20230220-231500-0.log.RYK

MD5 b92307f75e6da82d6c54a88930dccbaa
SHA1 35b33b7b9bbc7e25d22e610e64945ae92932b31b
SHA256 5a3977c6f6d3542fddcc0defdaa5036e38c9c84eef43506ad7059cdbdc563767
SHA512 3b75c68cf57371788044fd0f1e9e0711ecf69b9fbebe981e7584677ca091124bf19077b590d16cc8f14a83877821147bfa3adab830073fecca0e20989a2289b2

C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI13CF.txt.RYK

MD5 b57ca11a9ffee673e703c368337097fa
SHA1 ec606d4e22a80a02015955edc7b283122bcb142c
SHA256 6b76aac9122c618976af1b81fb12fa009653c44ceb2c046a04266c2a6c9cd153
SHA512 8059f917e818852e2987f020ade48e394f2a4b6a6a9b68dcca33895c815e9908a3fcd3e2b51a7935dced2f6cf144a00cdc2c23a7221996bb2df113de84663b2b

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\WindowsMail.pat.RYK

MD5 0c5b2aaf2630c6d8be220ea94b363394
SHA1 df2e853bb4fe8a87785d706296e6cc9b66402632
SHA256 1361a57253c9ba3d77b002d9c1393828b4559dc313f8caa655e5e6f7212ff4e7
SHA512 5434e7e7de6c078f490b448e7ce73c2c3bbb536c7424f2749af6e298a430e0863a0286c3fbd94243cccd11d0cb5cac4bdf748ed9293586f82f382681af108629

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DE9Y0H7M\favicon[1].ico.RYK

MD5 e355295012354981bc5cce2aeb37024d
SHA1 70ee2869abc455c6f087bc05d87e5ace72630c50
SHA256 113286842a6a355901d17962d0fbb4d10560e94d427ff93e41bf2aa79ce0418d
SHA512 c5c8f2740be24b2d6e629b18b668f968a8f00e6fc339607caacb14c71ad5d27de9504d5f6c90d42815ad9f5d7f71f955bf3cf83e5f890c36ffe1fb85f82847ca

C:\Users\Admin\AppData\Local\Temp\SetupExe(202302202305545C8).log.RYK

MD5 87cacf2a617e6681c6588b68cbc2cef3
SHA1 16187e412b6724e6d5c45028243358b8b9b052f2
SHA256 3e681eb70cb196c3f8f246813f947408a35bd96704d8b3f8da1377196496d996
SHA512 55a1beb466bee299610f059a508f8b9214ea2ff7844c7040acdac66b1f1f065bfeeb1978aa598a61000ea03a89eddc9d091f4cd35d115d3ec361c0db5f847e88

C:\Users\Admin\AppData\Local\Temp\lpksetup-20230220-232322-0.log.RYK

MD5 428ea1f443c99e260c08d0adf4a02680
SHA1 fe39b6996d76b80375c25abbb5c50b33555ac4e8
SHA256 bad41dd0a255389a8098f2a4103bfd3bec4ef5f1a4415e2b25895ddbc2683231
SHA512 df5981a105e7aa1db99134b90dabab0e69ab252d52e7cdbcee0a2d4374147118acca9be7c62e830a287636d9e6433167f3a44d17b52c476756873b4a31589fb0

C:\Users\Admin\AppData\Local\Temp\lpksetup-20230220-231735-0.log.RYK

MD5 44e19946b90f4a197bdfc403a14a08c4
SHA1 c10f431c5abff6582fe5a73e3dac189b49853592
SHA256 e1573db84009f90615e64480161d0e19209da1ab70ceb1e50b570ec44e13de7b
SHA512 b394da4fd88ef020c4bf2efad9dfe20cd84fb720a089baf81b095817cc1f25349e824f040c8456a9f98b58f84d46026e6b274690bf71e330aafb3b13b703e631

C:\Users\Admin\AppData\Local\Temp\lpksetup-20230220-231216-0.log.RYK

MD5 cf03c3b7bfc5eac2f15db01aa12760f1
SHA1 7324ee3065b4d63417c159c2d88254c9e718dfc8
SHA256 a3b9bc6f19b5df9770daacf2710c0ac604b07fe826ce7d694819fb53779f62c8
SHA512 c405271e3a39ffaa05eca81b9d49d495654cd3a1fc9fdfb2c7ecb0541657abb81b2c06120afb69682e23bde6d9cc6f75db18f3829751555bb9d89bfb8a14aee3

C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms.RYK

MD5 d1b9585ff9f576341db29a37cf7bbe95
SHA1 4e9d04d6f25e5ba98b2a818d28f42c69818b1408
SHA256 12d90f780ff4d5c913003653482e09125292a7c32484b0195d14b70cbd0be87a
SHA512 d60f0358598be082368c173b303cc7c7a1bfce6f11f5dd75e4f82e60feddbc9bf340ec00cc114a1f7bc31dc582e95fb58b7cc5c7a34453ffd5996daaea108a7f

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_372.wmdb.RYK

MD5 492b4321f96fa045e69d59ddcd7dde17
SHA1 8f7febc266a227959fa028bfc0972c80bba4e81a
SHA256 9980badd96c0eba62992cdda27d5e83fefef08a84c73f1a50fa80c58a3a9e6b4
SHA512 97e6e86ccb908d9c22887ae6704f6ff1c2933e6802dd578d150d67eae72e20247585f4328fb278d2a7d2a27e9158b24e28e58504d3336ba90894a6f454dde314

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\new\edb00001.log.RYK

MD5 2974506c62047f883aad28c7df1dbe5f
SHA1 6f86d2a7ff0e8ecce308e62a907487ea2bd86bf1
SHA256 324bf4c1c30a143dd4938ac9531dff5c0bc6ee52e7e9bfb50462b6bbfc896420
SHA512 4e1ac8aeafec18bda73246d92c34bd70a96b1250fd6c4fad98e742c8d9f4717422883fdeb936a3103367cdef3c45a303fef58c37d969f6f4c8479aa373aee57d

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Dotted_Lines.emf.RYK

MD5 4f010c819003316508202ead294eec34
SHA1 f03435ef7e185df430321974ebc647a00a9b8daf
SHA256 4918a271ef39f65d29570eff293fbb42e560ac1f441c596ee212af07cf480e7a
SHA512 359cfffa1a05a17b9b0eb7a6bfc1931ea101b4b0a1cba6fa396bf53165016258ed0bf9b5e2b94f16d0686b5a30885dd0ddbf38ff200f7137e75521520df2fd74

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.htm.RYK

MD5 b8f7132edff1bff3bb489fb3ee92f468
SHA1 4693b1470dfc8c3a396f4a68e6a7c57a9db9a183
SHA256 f8c42b8e33ffafcd86927ea625b83b2912baad44629d688072e5b846a7283e8c
SHA512 21e95aa0bb331b5124df48dab9b1304368017ee4d9b2a4c2dfd9524a5b8cc050634b192bb9776d52601e1c7a32c29fc0caef5041d995832f80dd854ed6293917

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore.RYK

MD5 bf87a178ccab585690e41b48edd2b59b
SHA1 f2ff293da7858a4fb8ed32aee2bc53efb14436cc
SHA256 09c4e1d5aff3e1e4ef4a4d5abfd54571c0ef8649d6f05eab0115ff9131fddb74
SHA512 73fc02f46b357043f285eba27dd848f377ae31417c8a1e72f2a28a439eb6d0cf724c2914bde1d30a8b296c0a48c6c3b4cf1486b3c55e3360a7c4dc2e001522b1

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Wrinkled_Paper.gif.RYK

MD5 3d9022cb33dd8911947073030b6882e2
SHA1 e6e86e64e8bd293ea39455642619dbcfacd7dc35
SHA256 1daffe89805be89391f891973f4e651dc3fa68dcf6a342ecbd0d5dc072232131
SHA512 c5e5adec8c0d668cfbdd6e39f86c01968dbc93b6d1fe4b0c9940ccb68be431d3730c8cd2fb020f3238425b2919722521e4027f915a0dffea5d397ee3af6053ec

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\To_Do_List.emf.RYK

MD5 642ecff8f711e78875860adb74ede7b0
SHA1 ab0e297eb5a73acad5878f1e4d8e139022d89604
SHA256 7f4c537c445a9f81189d9527c362e481eec71ce3bc38756e00f75c755ed1f6d0
SHA512 7bd76e7bb152cb4a911725c6df818f00f3340fdd3e7f50600705e8a63544eb0480de75aef9f6c396a1e9734485e6a492d0da8ef39f48c87e6d0c157c654f2bb9

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Tanspecks.jpg.RYK

MD5 93c112062f8f6eb6ef5b88a36d1a2c58
SHA1 a8b5e84ec5b79df616e71df1859f7d6d3ee4cb83
SHA256 3a5a90fe7df75ccdfd4fadfa0d96741bc44e09baf1a522c851dc48a383ab80a6
SHA512 5153f677fe76961fbbc4fd904e11d1f7fbe6016bf930bd30c3ae9fee1a380de869beac9a2f2ce767612055d0c4a8364f58b0c0b0654e7f80bbcbba72267623ed

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\SoftBlue.jpg.RYK

MD5 b5e968582aa1c54ba58ec4c22804c4d0
SHA1 849883847e7451c5265b4645ff7bf2f86b05a57c
SHA256 3091a3c3cd127478c50747bf763ce255aff7f88459661c6585d493b7d05b84f9
SHA512 091222725feb649fba2a3a9d5774cae04dca6c6d7e955fb79befee30f2c57d1723ba9def659b68caacc41765acda851eb3df9082daaf53106b28bc9999c95eb7

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Small_News.jpg.RYK

MD5 7d2b899265716ad00639bdde71d41933
SHA1 e4e1e375c454edd06c7c1a44792de4792394b218
SHA256 34649cc28f8487e231c363ac8f908a5e6a4c0e779878fc1e6785a619db810038
SHA512 6bd60fe9fd0943e2bbe763dc50d7e34724b56187bd6fc7528998d48cf77e7f24fdff52480daf98e29f81c21fa708345c2429ef1e118efaf06af20088409adc3f

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.RYK

MD5 224c1471b9c1775844513c75c3f1c2fa
SHA1 a43367502b2844a94f09e993354aa36561f1de8d
SHA256 bcba5b2de46a032f8cf337eef634c45c39b14644b7b599151979573e669b11c8
SHA512 bb6f644544954f054c954730a398bfd32e5b1b6528f00d7c2c41886ebd7e72bfcae5db6d4984ddf3e4c973570c008f624c629b28fa9546a010eceb606bc74619

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Psychedelic.jpg.RYK

MD5 58ad80cb41a87d3b62d20b54dbf9831b
SHA1 600c34bcf93658ed9e226f170f27d4fa28e6ff4d
SHA256 ff572fd920adff69c73d0c804643684e4d36809aacc22ba8e5e3ed1230632f66
SHA512 6942db1b5f7ddc7bf05f8fe56747cc71e4745df96ac3695e685d95d092a6b1d4149112a069cd189b184fa03bc9ca311c2721ccced9d264abd89f7104e942679e

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Pine_Lumber.jpg.RYK

MD5 31bef7c3ad9f08fb8acc6eae1bf40d87
SHA1 aad693891bf39a7a9a39d73a8b57e2ff57564030
SHA256 4be351e01083a4e54d818ad1650d57bc5e777c5c6b7a8654a6335203a5d1d875
SHA512 8bc50156ee071e2f7c668319e11693a91c33223e53aee23a19aed3e871908dd77b62b6fe18f619da5ee1d8e76fb9ffcd4266c5b662ff6598e3ed4ad439becf7b

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Orange Circles.htm.RYK

MD5 f4efefe618de93a473225a50f37feb6d
SHA1 e86020353844de39ff4ba4be3e772df282d80c9e
SHA256 c230a191ea6a0485cf92ab217b760f1c3515c03ba7e5f568646a37817314adbb
SHA512 f5c5b982e531564c4fc42cc1156f8d978323d3b1f2afd3f3298da622d4fed10c2a2f3c08c3a63fbc45bf9a08bb225d7e36f3098aae817ebfa9e6f043e02f4645

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\HandPrints.jpg.RYK

MD5 d2e4c1aa37d187d876c1ccf7df2d8894
SHA1 57efd6657b991eb18ae0beb13394944d8d56b645
SHA256 23935e2b65d5c49b3c52a0b2f329514a3af1550eb464ae246f2c4a457d1aa0ca
SHA512 848d79ca3c050715a9dbf4725189bc22d6df720a3adb9913ace1b6db46788481aebffc26b71fa67b6f0e3b37ad796d4cb90ab79c6ec3094a759bd92eb878e031

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\grid_(inch).wmf.RYK

MD5 58d99d820c2bd6b93160da3684c07a1c
SHA1 f2652d5f4d8faca02b90203eb31fe0d77c2c4cdc
SHA256 99698e0e53d928e7c99fcc6d4efd88beed44f0ac09533dd46d8ca20d51982d14
SHA512 bfb944cd60f483437b6e7932091fda6dd092bfd6dc02910ca5a4c7f3970555e9e4f42de9a95eb2421a0461571418d672e391397136dfeb10b99f080a368e0aba

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.RYK

MD5 2fdde5e4f8036d505f6ba560d6d2a7b9
SHA1 26c717f1e94aaedef48319cd1cab26996777fa7f
SHA256 1f48225b6608fef6054e041bfe8f91743c9deb77711bb7e75fb2f27bf4184f59
SHA512 c23470157a2e30611bfdd0052bcef6fab4269abdedbabfa7faf673b663874cadbe9ac6384faece23719f2f5f8455c858e278e066cf5d4dee2d3e89d596fc5118

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Genko_1.emf.RYK

MD5 c4dd9e6dcb9eec9c4157e1a8ae408f75
SHA1 7bfea26feb9d5979f57cbbf55df07680a38ac802
SHA256 f454d0f8290292cd8d0f54ae75e8052974eeb15901c4123c5cce440146572f85
SHA512 c3a84842d1c63ad14d549be9c35e3d57bac603345a75408484999105bfe637ba65e776de3b2f84d4570451a849fdb0c5cbbfaddfcc2f74d4c70f23272e82d1c9

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.htm.RYK

MD5 a0a40fac7798492bef5eb1d52f4034cd
SHA1 6e8d8ab564b364e6abcb442dc9a570b9de3d890a
SHA256 d7245cb3bad3cdff0178226786412a8edb3cbd2f3a4c3ce3083974217e15fd90
SHA512 d9149e8a866e1fbc06b7816122b71eb79cefd7b5a86564742492ecc76f03317ea8e1834fbada0f361a4293146348668b54adf21afa7808bd87697519b454beb9

C:\Users\Admin\AppData\Local\Temp\e3fabe2f-672d-491b-ab66-fdaa7b506227.tmp.RYK

MD5 e26bd6ae8e9bd70bdebd3e896e628444
SHA1 b90187e838f30a285e7f1041a52ba361d824c282
SHA256 6f10ff05caa79db9b2bd2917575415703454505775623a16833e4479c338f1f5
SHA512 2cca33eee9d516876f11c093cbdd06951702974ee0258817a33509f29245a60fe608ab8272654350e78d54ba841f2ad053dc64f68fc28df7f9353a37b5689b0f

C:\Users\Admin\AppData\Local\Temp\9212e02c-a73e-473f-8092-effcafe0f1fe.tmp.RYK

MD5 05ed4bb5fafd1d3f11db0ab8082d7436
SHA1 869e75788b0b11390c3e59741792c6a6f066e7f0
SHA256 3719c51f1fdc653a20d0c3506779ad2321fd7ba1c99029273f600eec32413f78
SHA512 8148208b7924a639f0eebed178748e4bca958c17d5b0f39e02c7205826ac80429f3cd5de0ca206b050e5f83b9110cf7058de7f7956a36d2d1ce98a87cd5f8f5d

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Connectivity.gif.RYK

MD5 94ea6f53fe69c6fa8e8d16591419bb48
SHA1 02863ec7a704a19bce7559741913d7e09d70cb24
SHA256 c9f902fe3ed278312779d10d32a7f214ff25900cf8856dd45626037576af6f65
SHA512 0ee66bbbafcaef141ebfca29303ec9ecb1cd5bf9a8514e482ef79b0bc588e64d2f11720311201995984ecdf9955200a734ab6a780803c141f6f66c384bf39743

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg.RYK

MD5 4957914e3c2be3fb234609df31e6c739
SHA1 c60566b8197cb06cfc189a051b183ee54b788a36
SHA256 748eec8e23c2d396515d7411a4b2b1b94bd12681b08a92337552b280d42e564f
SHA512 100848ecd7668c56b4cb0e292d915d4c2c6c172b13d009534430c4eaa9f4fe7caea331e824d0b4da6e7e0909c53dc624cd3f84ba7a326b641260a0d87ad82c77

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\White_Chocolate.jpg.RYK

MD5 45541c510152f18f8649541fbf605a72
SHA1 5d893e58d6506c19a30dad545d5453bbcee906b0
SHA256 af76e27b0d78a1b5847de1c336551ca22c4c446a3e7ba7db9fffbdb5b64efda5
SHA512 965ae79d8469ffa2fa823a8f65844ac8c933750825a915f0d40c5f5c562f1583925aa87a0b559aed9153aaaf2fd0a7890d77e4816e814867a2501699b9ee9d3f

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Stucco.gif.RYK

MD5 fb4280ffbd95e8cb252fae6007d41d28
SHA1 b34eb0c03b33e9a6dcdd0914bbce3afbea0b9893
SHA256 0541a43418867acf03b0070bf69c7741ba6ac91a0806806f1bc0cf1852cd94a1
SHA512 cc22ab2f8a8806d2a577f89b524ee59dbe0d12fec79846d33753e02d2a351bdf86718f7e995074d53d9d9bb922b8d9ba13dacf59d52beca37edc088b793c03bd

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Soft Blue.htm.RYK

MD5 bc0a28a1a08f7680b2428c1ff746f37b
SHA1 d5ad40017298efd67d963dd7e7323a6d7ad3062c
SHA256 00f97444e2fb1be006b36169659977c4760b6862a2126b7cc94765cdfcf866c4
SHA512 9dd7822fb0f2321bc89ac6444e00a248968acdb075d01d066379c3b80f89fe709785e0e5eb8212d75ebc61e5cb9ceee9c96050af0d2eb66a0b60f9c7a2108a49

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Shorthand.emf.RYK

MD5 572f49be0e9254a34c585e199469f13b
SHA1 6cc0d00225522200a42a3f366658f9e411ae38c6
SHA256 966b5a8f904340c2c61bfd175cae58660342c3729aa5178ac2b665e1155cbdf6
SHA512 08ca32e773bbde3f4c32e88919239d46712e1a1a0ab6d4b83addd3b46d4dae5bf1e5577935531e752f4dac8c57714cdb66003a26873760751a457bce8cac9c58

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Shades of Blue.htm.RYK

MD5 ccfb80432a191d0b59897c8f4df8a9e3
SHA1 8024be5a36beab601657ec5b14d4b7bd378f41e2
SHA256 678473f1ecce72181e193b092523383f3f0e2213eac7c357b8d5f2f10d2e8c28
SHA512 43242fc4d737551ed78cde12eaea1747de3794855aecacc3fe631762b3cd7c5a3634c0e0b6d2986222d39228e7cc14977319494d3f1f44946f4456682ed8a967

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Sand_Paper.jpg.RYK

MD5 2003554049e41db47b9a6da6efdd80f9
SHA1 5869a6175ba823e82f70a45462cd53f9024cf3c3
SHA256 58198d9cd6346c2783bf57e8252908b2069380f37b7f4f072f80fe6968f2d575
SHA512 4de0e1c738765fef01fae1f191526ec0186e0731e8469a60590c126eff406fca105522146f62063c0098b623964ce9772d24442abeb1726646c7c7e1ac5375ed

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg.RYK

MD5 3d36a727c75ad9e8d7ddb39ec05082d4
SHA1 dff97884f78fd8d534e0387ed33ff38a43a0e827
SHA256 0a925b6564d75e486244922c3584e78ce258f2297dff04071a7fa16abf4fea2c
SHA512 8ea423f3b17af694b30a304262edfac451abceaa264a40966440538837f325d58cb4f7bd3e79af1d72601befab1b48faa961e915945a101639c945fb1a5dfe96

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.jpg.RYK

MD5 9f901bf82cc763b3bf5f4c0c2ddc63a2
SHA1 88083377167e089d461853e6abbaa07d332c7f03
SHA256 199786f8e6fa65fd520aa56f6503cf8ff0fdb50ec236e36a116538e548daa680
SHA512 892b4575ae16d2b94518d591243c87dfdebe2f921a360315838ab8df6839a521b36858abdd17edc9da9f423371f0b9bc526413d7d9f6df605a2f14d5d8778a00

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.RYK

MD5 cd87cc29171a21040422ef9137ed7350
SHA1 835a0706a48a72f76910906e083105f9efc63132
SHA256 5ee7af7e66e9b07280637d890ed43b766af279d6ecbc9d27c454704f750f848a
SHA512 4b2bbbc4943fb76dec1fe838a9c6ed19955c3ddcf9c0bce82f400d827ac1210f4075928cea32471f651f2c267be6140733580018dd4dd13730fec99fad6a959c

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Notebook.jpg.RYK

MD5 8d7ef3dc42aaf0c98207cc03f3cb4f02
SHA1 b96659a50808450058c0801bd21ca8aec6d26ab4
SHA256 24b85e7f3c104cc0d685c2468fc92d41e1fc2bb0154415c575551982b5de5ab5
SHA512 971b484892588face72ac48ef9d46d3951e28840847ecec07da4228f0a7965142cd52bfd3179df4f9b953d366f5c146a00871677f9a49ac8adb612554b0b86e6

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Month_Calendar.emf.RYK

MD5 98899363cee391391949f1d2a9ec24ff
SHA1 70e1a5a5f20dd45655a7b3a6918a682ca189b1c0
SHA256 543afb1b91fef5bc4fa12d6a8d90b7af64ecbdf1bc34ef90cc6dec5febc37119
SHA512 708cb82a5de6ec3c37601842b4324afab7bae8594150e7342a004c841777f25b68c2ce4fc597b11840e23ab64a78069dd3d18a05903d1162f992f70835c5c40d

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Hand Prints.htm.RYK

MD5 ae0a718d102d2fd0b10fca2f1645a568
SHA1 504c076bef7b79e1164f2c2cb978d4528ad2e81f
SHA256 52c686a208df8967135c271b983009212fea5f14f75a7cefa6d821f1fbb27aec
SHA512 0c11b671bf4f5808c7c594395c9cbfc0321f76515e0cb1762422c5da0b61c6ae5a26c3fbb6661a27774749c37a3aadf06de77c3dd1b8f94622495586e046a860

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\grid_(cm).wmf.RYK

MD5 6fb825d2d2f0ada3814152ab3726029b
SHA1 d978e8eae57685371f13ff3b3fd821635e0c60a7
SHA256 78ffc652b88d9935b6d67b710f97d9d7292bdc57d886a09e32d9b4babe81581e
SHA512 a396b3333b35cd4dc4272f04ab13937d62700cfb310ab3db92b63849ebb8cb3938d011fe4516d3abf1d54a86a774137f590e0614097da9abbf58ea94a5c65edc

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Green Bubbles.htm.RYK

MD5 e932dc5befe8c459f6807d3e2ba9557a
SHA1 009f0906a697a501217e9a5462539a2a847f62a3
SHA256 93288c0283a40615f114a287fa1a4594673360e54defa9f5df5203be954157e1
SHA512 8d3143bcc7ae29f9ae9c1ad8eafc5601f73ff994c2cac05a56431f536b3799f9945ed185aee8f5151bbeb5c2e70ac80228d0ea0da281a7296bb2f301e1ecf5bc

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Genko_2.emf.RYK

MD5 5c1f02dea296d4853823d6e717d2645b
SHA1 b29dc7daa3d030dcb48ec52e9b4f11783f3f48f6
SHA256 7293f58ff83fd0522d171b20ab4956963bc0ba715b8787d49a3396c4c672ff01
SHA512 62d226c477baf5ebe3c04b07fb410b110f82aa50aca90ab3460a462c265c8dfde1ddec94f6581c0ae815834ce0ac03cf29d091f8a28dc0b988db0e449e0a41e7

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.jpg.RYK

MD5 0a034219f16307e10f5edb10f4588862
SHA1 66ff6ebd61c6c2f5491557391f371200df7653eb
SHA256 cb20923088ba8c25fb8e334975322ca32b68dd715cc7b78bad03597b36f1f487
SHA512 612d2a39f046d433a3349630281466e81e83e99b9dfe9bc688c172a1580a511ae2009e95f0a5e92569e22a53d9b74044964cd2c28aa9dd02f6e228ed25fb374b

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Cave_Drawings.gif.RYK

MD5 65b3ee75bcf92fbc3bc0866ecc052496
SHA1 7b8ec465c8c47cbffa208665e7f5e1112b457928
SHA256 3761e2d1aaa169c28c61a61722bf37d8140cb2ba1582de34cd5c4112e0e175db
SHA512 1a178038247f503f738388987c2d5cb2865cd35b8ed65d551e60df4b6fd32528973a48db4092ec4337c47f7ca031621703c3c8eacfd32d2f01dfb22e929dc038

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\new\WindowsMail.pat.RYK

MD5 9b72aa4588241e9270a15ff32e71e54a
SHA1 8566a252932e3ea892ab23a4490683e31f7f7287
SHA256 c60d357407a617e2e846d4fae7e3ae82ed992caee619819376192ae4b53c8e68
SHA512 117be3293d63b28fdf1de6dc56de2271924b59911b63e65342f9e9402c9d2207f478becc869f2eec1b80746b430e6923077cebcf9a94d5cb25d6a01074587346

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat.RYK

MD5 5eeb0f8c23599af1488bb792b0d3b57c
SHA1 385f5676386b6474c417d89663dac36525703615
SHA256 1bf90fc4c29ef29f609ef12551d9264e8ec060e390f162343e2aebff17006f3b
SHA512 794a653b61b2ca382fc2e9d9476edfe9a3695f50c55a2e31919cef38caa6fe8bf0e4898a2908df2c835ea58cb81f25101ed207f40e8eca0b39ada39982b09c68

C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Suggested Sites~.feed-ms.RYK

MD5 884d4985968fc38146bd85e2638f7412
SHA1 6a9717f169ce918dc632dac14559235e343f904d
SHA256 4bc06d4b84f7b66232b883e73cf657360fbcda9d81b7ee0ed3518b95a2b9ce47
SHA512 5a9f378025460c44ede0eb1f2ed30b6e68cb51dae6549de8a584fe33990e28525c5f88d69c3919b2e9bd34f01ffb7403f99635bdd1d2cb5390d9132eae1fd11a

C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20230220_225945413.html.RYK

MD5 4ff4266d23a3cfd822a16a8981589b05
SHA1 997199be039e94574aabaad47543088cc7507b3d
SHA256 f8182205db4b06adbf7beb5928342cb97d8cae7dea837879f50718cbd13ac2dd
SHA512 64d19263983cee593fe59378cf406220d1692240fa8ce2772fed9de204eb4c8e37135919ae088881e328b9b7b6421790c21e1ee1dd8057aca5c50b9ceb5347ab

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440\msapplication.xml.RYK

MD5 1afeffd585890dca6d8be4bf2e67462f
SHA1 f4f9763db698a5403a72fea97d4f7f20e5b33198
SHA256 41dcc3e918e1faf1ab179daf80d1506f714939ed71e27ee4acbf7a73b1aa341e
SHA512 d079110f7e9a10fb54be3c67022348be773144f6614cdf271a2e051a2575d0505e84ba45db60ab70ce8269cfe0014813327c11901beecf7253f03933d61cbdd4

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\p734dsx\imagestore.dat.RYK

MD5 aff9ad369523b937757f44c56e4be3f3
SHA1 e123eab9c98e51cfd6ea17142a7dc0e33d0e09f3
SHA256 8feb0882003c604ecc4ee5fabc38ee6dd1687c00407a65809cb50cefe7e45166
SHA512 9b0c6b212823588f8e4578230f1054782a51fa40a4587dc94fb15be25b49c182471baeaebc367172c6a3089e79b682b9af4eacbad1e2a449a824fc14eade9841

C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt.RYK

MD5 518e0bf148b0ac5d410c1c605a275a09
SHA1 af20d3b4ab8f35b348076c944a0ce9fde82214c9
SHA256 31aff0414389ccc73ac29fc9eeda93c1f7122a77f9658ee13096807ceedf8436
SHA512 0abec685d12c65a878528a0f85726a035c39a0ebdb19751bbbcb182226403737b1d6cafb59414125ea187e2291d1a78e67f87e50840f3b4b5fabe89b50ae403e

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000077FC\12_All_Video.wpl.RYK

MD5 f450a43fe8b29bafdd4421d86b9672cc
SHA1 a659773535137ee42b4999fb9a09270e33d6ea3a
SHA256 c53f97cd511c6d5f845d65733e670514b94533e89da8aea6a11145fbb2c28167
SHA512 97b522df2fce5d202056535d169516dad0d8b4052db3bb7df6875a931c3ab56ebbe97f3dd319b6f341f2ef520109a962cde64f5d88c0c0140ac524f50e13127a

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000077FC\10_All_Music.wpl.RYK

MD5 047b590decef2aac261b974b6b2ac0b6
SHA1 ee9ce8f0d6de49e034247864cf6907809bc0055d
SHA256 41a9dc3dba038bf5c3d547406a784f2980450a314c4f2669949b903d1173ca46
SHA512 aa235c287d2311e7fa075e6878d72d2fdc33818d535f4466b5923e74a530850e8e9bdba1f537d258d9bf0c40e849d6c2869125bd2ce2d7076c0e746208a42e58

C:\Users\Admin\AppData\Local\Microsoft\Feeds\Feeds for United States~\Popular Government Questions from USA~dgov~.feed-ms.RYK

MD5 43a2070ef6723b4da593ba502527ef4d
SHA1 c3bff46496b97dadc2394756cd7478ddcb351765
SHA256 a3a14eeddd01eef68b1b59323b9b7f813fd674e486b75f8ae9c289a3bb7d16a6
SHA512 e9afcaac661b699bed806b36ab655f9ab7ffdbb29a59098934e9b0a750cab90d893a680e5744ac07c003b2d06654b7a7d441ffdfe1494a1dc71d2ec787d08908

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles\pin9728060290\msapplication.xml.RYK

MD5 bbf7f0a55a6f54d381675b463fe4012c
SHA1 ddd2c5cd45f92a68e95bec98acc8856ff47f9fa3
SHA256 b6136c6e2a3880dbc33740da58fb5a981757d331cb1bb106d0aca503f1f6a1ac
SHA512 76271360841cffbabe3d366ecc57d5ec008ea1743989a1013d6f9a75627542572372e42dad67d27bfd25d1603b170cb0477b2ad43bf08a79caa5a5cee88277c1

C:\Users\Admin\AppData\Local\Microsoft\Feeds\Feeds for United States~\USA~dgov Updates~c News and Features~.feed-ms.RYK

MD5 f86ab93fc01b6cebd6620a9cd4bc65f5
SHA1 57c6712f66783d428e26c73645b62c7081e91cc7
SHA256 eeafe275455d68db769457b3496887a91824c9b5304ed59b2ca8a56f51bc0d9e
SHA512 e1aed51e6d268ef30746a173db0025421a0fc75cf624b0aa8077d17543ec02cba2d869a54ab6d1287287c5f64d632361d31ed07647974cf7cf3b3c471bd3ed51

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000077FC\08_Video_rated_at_4_or_5_stars.wpl.RYK

MD5 8310e0987e4d516b9f12c74e9222b52d
SHA1 23cd5a88bb3cabc74fb6091afc00980a361efd52
SHA256 43a67f82523f857d81fe7af98c36541bd4b6a44dfb74dfec4bf6a893ea714de9
SHA512 01af27de9e011d313b1f546b9434a87c10e7f4a36902bf691416dc54b8685325222f4c67a7de7b411542860d4df4cb8dfb484ad890878151027f4e1abf60b0e1

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000077FC\06_Pictures_rated_4_or_5_stars.wpl.RYK

MD5 0e828ba2bc90c88dcafcff3e50eefc07
SHA1 91874127dd742e3430931d1f2522ca541bf66764
SHA256 eaabb44d6467920806de9b02d11e18122b94fb59dc8a1242696d2abcb840a8ff
SHA512 23caeb8edd3c90fece1b134a4ac3d4d1bb15f1a6ff170077f4ed6bedd090fc688520e33a03fa49ff0f3aa3c971a86da29054942d09ef6ad3197bd23198a607f6

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000077FC\04_Music_played_in_the_last_month.wpl.RYK

MD5 7c5b4839e10751ee140c9292d47bf861
SHA1 51ba15bce27296ad272d64bb5374108feba7e4d3
SHA256 695db32c81e67e8402cabcf0676c79fe87459b8990bece03e1b374450a28e6ac
SHA512 601d3f1d65b0a30fce69a0f5011d84c385255c629dec88d5c3a57024ff284201b1dda8c8b51830f2ba15f5bdf9a8fa18cd6c477402c7b917a5c9f1b72d8af592

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000077FC\02_Music_added_in_the_last_month.wpl.RYK

MD5 20eb5b7c6b2acd018472f5ffc18a0c5d
SHA1 371da9f8847af48a1db8e5a18e2d2afb36df55a3
SHA256 eac3c14e77455fc574f21d6f6b296cb4a0d94206b6d03b4410e882ab88da9901
SHA512 67c42d4cb429293928ed0728e2207c7268c55bba9d5003b0b6a23ed16213d78d0654c6ca1994a959c99da548037ba3e90cb9d323f7240367736766d6545b0699

C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Web Slice Gallery~.feed-ms.RYK

MD5 3f09b65b30823fbdf1bed7c31762dbaa
SHA1 fe2f177ff613f3c4390d92aa7e94801be2e82af8
SHA256 080cfecde69d28da4f4a157834ca3958a01d44d23a175d36d76c9386ee9a760d
SHA512 81824a83ea274b420fdfec157b6c544b130ddfe3109911ed9b644961c0b5f477282b7b3b292aec14238aa7a51d2adaad9e0d3b63b942fb99b3f53eb2446cd159

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000077FC\11_All_Pictures.wpl.RYK

MD5 97671086be04a3920d038b06f22600bf
SHA1 c0a040bc45320fca59f2ac434e3f94779d0bf26e
SHA256 9a505ff5b9edaee38fdd27ecde830671ba6999a1ddc9e03e06152eb760675ecd
SHA512 1d9c00878524734b2c88d8ef88e01148b96d14c58e9d23a20d86d7af2fc79eb760af3f8e438c2b586d84ec97e1b18e6743943dd16d10c57791827bd05513fa9d

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{CD5BE32E-B173-11ED-92D9-CEE1C2FBB193}.dat.RYK

MD5 b0a58410d0ffd9845103cd806eafcd05
SHA1 7adb9d257e79523047fa3e2c4c824b6ad00f5106
SHA256 9cfcddffcab5e61c6f58cc52b0915d7358dc1ba08147967afaf1974e8972b05b
SHA512 a245364b44c12056f3e923d2f93a557cdd54422f3e8bc66326b97fede9ca1da9df9b9c2871c394aed929ab1159e771b216b2df5a6f04c6113b2978d34246f7c0

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\account{519A5D0E-2C5F-4323-B422-D1C8F055886C}.oeaccount.RYK

MD5 8fcdc85e009c70bc0fd255b937544a74
SHA1 6c1db5476b0383de4df3880ec3614c8c015b33ac
SHA256 a97bfc7b52d50006f7f9948298d99e38f5b36a4b23d69bb8a36af6196405a0fe
SHA512 52e7183cf89837478e8e381c6bb5e2d5d896f1c29b1bb27290c561ee16ae693d21a9a3a1350deec6fef84b6a11972206cc560fb6cf82e74cedec0cc2f3a0f852

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000077FC\05_Pictures_taken_in_the_last_month.wpl.RYK

MD5 a2042122312ccb31a1205bcb93c5fc05
SHA1 cf9253017b9135b4dbab0edf74b009cecf47bdcf
SHA256 0400140fed984810bda1ab84b0dd709ac72db293d56a4a2f7a9d2a63f07ee120
SHA512 c0b68713bc222128011162c18f194b9b166e9780683c73e8c0b71a008a772837afab9df9625cfc5ea28b8cb51deea4bf71f11f214d35864d02d134d838daf64b

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000077FC\01_Music_auto_rated_at_5_stars.wpl.RYK

MD5 0ec4a6851ce5fc3dac5ab491aa10b7ba
SHA1 0ee4cf3110c023adcce4a38491d3ebc0b8e1a448
SHA256 632bb0502596541e3fcf190cad112e3be403b50a83cd139e4822ad2f3e6bcdd0
SHA512 316b45539af8584e7af7cec8dddc85b27ba5887be9c202b2b948896ea76269f9728fa3a185a1c909d0ee6002f73edf117e039f21b1bdbf3f1efa0877b794de5b

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000077FC\03_Music_rated_at_4_or_5_stars.wpl.RYK

MD5 d292cbf2a8797c75bedad57d8e1687be
SHA1 20f299e72dcbe4a31b14ae40022e4c6bfec75251
SHA256 a4feee5197c141d24ee415859b35433e59619c89ac594ecbd897221cd46a765c
SHA512 7cebe37e8a6c6ce8a2fd39c2663e719343150a9d9f54244840197e214843fffc712008864c1c861ae0c5f7b1b80b3dd6c6da60114d36bdb3315da584ebec4186

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000077FC\07_TV_recorded_in_the_last_week.wpl.RYK

MD5 cc581f3233c08543de2f9d78ca56290c
SHA1 ec86c159ef631774f8297fae19442f6f6927f477
SHA256 a9f46059c9a195176bb099c159577fdb0bf40c413762b25d98afe539bcf3f6e6
SHA512 c467251b7ab81f1f234e77b68a54ced13659fd84b4fab0203f3e0897d3021ac302986187551e8c5598e2173dc07f51cdac71aea222c85f999b3e0552c9976d8c

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000077FC\09_Music_played_the_most.wpl.RYK

MD5 1b0f3ed98dcb610047ee0e6c276773f5
SHA1 99a6771a43dc5d9f7bf14f87e0194e4a1c657ad7
SHA256 20c50b8fbebfad3a150b60a39d291db4d5a7ab3c2e44ba45f2738c1ec7ba516b
SHA512 31eea923b73c82298c331c6f512440b419096dcd00430817c354b65597acc7fda99d6e9af302de4ee92ee4aeffe0fbba410d6b5277d65c20462f38f37b196c26

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\account{47E793DD-D27E-46CA-95E0-A3DB0340F948}.oeaccount.RYK

MD5 0b36ae18ea17fd68cbc7227c3d62ec09
SHA1 d714306bd733a3c6352d7edb5539d8e1dcd5edf6
SHA256 5bcf70a4d5a6a86e7efcbaa6e0664e38dc88603d1502b815ea2ff84896fbce97
SHA512 4f9a73a3a64ed97d489184c4cc30e2d02c7d28b79a5e27b2a985cb83173e66dc49929606f107527db8b315537e75bed70ff81126ae426a795e5217a9596ef125

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\account{A2F0254E-4ACA-4342-A77D-650893DDC013}.oeaccount.RYK

MD5 689d84889f8d5e419a6ef2d606b43c9d
SHA1 83da52b8537695814855be7563512bf7fda21fed
SHA256 3acbcf87e15c5e73951c9a0108d2396c5a496ae59f3ac14063e80c3dc35974c3
SHA512 9ab56707b40fde77fba9f61947c1702147f4b3bc2e24890b8ff73fb3ae6b2d1ca047fcbf9d21f840a4fea9258d5afd4860e74a656de371be323ae219a16b93a4

C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20230220_225945413-MSI_netfx_Full_x64.msi.txt.RYK

MD5 34556b42f895b50d037225dcde880fd6
SHA1 01e4cb3cbddb58df39b664b9c2d86a7bac22729b
SHA256 94a2ad0f616eb9371da3dfcf530ea848a1969d74923b6f071360da3adbf9423a
SHA512 fa744c2a1c7c92c88c6feac70005a271de3c4d707875e1db113b60c91a81e1a0f5bb5dd54de58c4b8186c179b662c60227c775ab39e5746b69a9223ecc061d9e

memory/1900-4144-0x0000000035000000-0x0000000035162000-memory.dmp

memory/1148-4743-0x0000000035000000-0x0000000035162000-memory.dmp

C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\wscRGB.icc.RYK

MD5 0ae98caaa80209c8724a8d5db9acb951
SHA1 f2346e31b4edad81e5fd826af4cbabbfb68bdc41
SHA256 b9ee4e6558f588bb06d855d770e3056de5c0dd02d62f152ce3f87cec7592f671
SHA512 50e70a91343ea4b71d8d5236b9c1c7227b4eb8a63f495172bfb7919cefdd862236e422744bedab4bcf581b103f75449567a1730540435a6c653152c5f06fbad8

C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\wsRGB.icc.RYK

MD5 fd129d4c285c9893e91a99ae1c33dfbf
SHA1 e80e33bb82557a30abd16c5c1001b3ee7e744d9f
SHA256 fa982d3cbacbb6d638a6ab6d4f29dc3c1c962ec72ad82fa33b2d4ef86f309622
SHA512 32db731e1f133b29033c2378c63d771f40da678f64077311a4a976e19c4d84ff248463ba8767a92610865a7c2ca1f41f586058d11ae0af2de1b13540c062dd7b

C:\Users\Admin\AppData\Local\Adobe\Color\ACECache10.lst.RYK

MD5 94ce053c1de5b8ed1b1300835e381c37
SHA1 f7991da37e4ab2c9f1863292d672f8892c7ae6af
SHA256 7d5414200421049feafa915cba2d7d86a9549fefb7a95ee6d5fb60cc73dcd6be
SHA512 8ed5d6bfcc4ccbf8f1761cdc745187cdb48011284daf01e1f98f7bb0498ac437ea8ff045987c0e9774c205adb9f449b5f0c830cf20deccc0e762413def8aa92b

C:\Users\Admin\AppData\Local\IconCache.db.RYK

MD5 c53bc602602dbc475dd9d57f72ab6a4b
SHA1 a9d3b826b15f649c3f6e5be9d1efdbd92ea7c5fd
SHA256 4c2dc6a26714c89f004e97da0c28e973190ad26483b95be2f3c79e262a0a214c
SHA512 13525cd180223bde9e61b97c81013273406b1049b97439e75b0f0448d78d306cc610f20b4da8e3037612d17aeb285f19abb6a1fc4ebfb939f93059c4af8c35b3

memory/1772-6539-0x0000000035000000-0x0000000035162000-memory.dmp

memory/1900-7477-0x0000000035000000-0x0000000035162000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\Music\AddSend.vssm.RYK

MD5 b95a10da696af31c0eb7d8cfe4241abc
SHA1 5a59c7085d231eac857e9a48e4520c619959081b
SHA256 e3d90e82a33fb8440593b2fb96745434f4ca74f5e8483e8499cfde2fbc921838
SHA512 4fad7617c779eaa3f4cb09c7ac3b6eb33ae3287a68552a72e93a7894ea54ec9340e76b86256581e8721b01f90bae761e17c46472e797ecd0ad124d698896d853

C:\Users\Admin\Music\ClearLock.mp2v.RYK

MD5 cb9b2422095680c3eab5793e6cbbd649
SHA1 50355df63746496eda1ad649592b4153ab463f28
SHA256 f21e7a639c7d58dd8000ce8e4cfe5ff47f6bfbd4dba699859901c84bf95368e5
SHA512 abbdc1e942fad1d17655f288e682ed30c66479c1a6ce4b8ccb57622aa57106a9fbde6b9e95e6546c40714e879a38d02ef4bdcb20b033635a94a84d6979ef91cd

C:\Users\Admin\Music\DenyStart.asf.RYK

MD5 42a525ddb2091748569a9a7ceb7bce37
SHA1 624590627b3b4ef91676f65a1025236744688d46
SHA256 4d6b7f5e3023a4d89ba7e85ba84ed9cc8de667e1a338b4d59c4f00739be6efe5
SHA512 a7d47757fd70d9f92425352daf4f69097d8f60afa4d5e9606c3889543b602b6e777455b33816bbd192c6848c5c262867bc1b197c72be74685f8620d69be85bac

C:\Users\Admin\Music\ConvertFromReceive.ttc.RYK

MD5 da34af277764f2fa127e0a5656977d40
SHA1 121ee6bfccd38b4be7c03bfad25f65fbbd436359
SHA256 ed10620e8ee7bcac46ccf38b0104eeabd6c81af2deeca7dec72dc27979b6b945
SHA512 06003170f0e50a69d02c582e024638ea265312af762c2ac0236f9c2e07c9128631d00b96cd8b4944dad92cc30667689b7e91e8b5695b8c4e37febe662fcddc25

C:\Users\Admin\Music\EnableDisable.cfg.RYK

MD5 c47b16c45704530ea462e61c014d60d8
SHA1 47fe8d0398784f6fd6a1784314506eb29694ed8e
SHA256 8593d2ac6ca329d1d6739c4dd6f79a509499ff6bec465e2d3af1e25781d37e70
SHA512 3ec3021d2e76366aed7f50c7cd69402b5f33df25f56c15b464e323e0a0ccc95b5fbd51de35c70f24e2dbf3424480672e1056cabbb64673237c41feb31ef50011

C:\Users\Admin\Music\GroupPop.mov.RYK

MD5 2bc0bceb5af7a22354fdd7f20752f798
SHA1 691f98efd8b266e5d91807c6b59d1023de267d62
SHA256 c3903f2cd2f9b32eee5cff58e3c08c75175c74bc87a21177dda3d25cf556b90b
SHA512 5140b7ef4dece93cd78be0926a2a4852dee21daa1374862ed9a216e992da2c0d09ca0a895997d8e112f8faa269fe15610c474927c9ddb471cd558a1ad7354c51

C:\Users\Admin\Music\InvokeConvert.ps1.RYK

MD5 4844d8d172b1d25ed59b478e3baef70e
SHA1 0e5fb4fa55e08030e3b11581175eda75fcf852b1
SHA256 5c82a0c7634b119d209f4dde8c370dfe846cc7ab58f713e65abc163e4e03e166
SHA512 2ecd1ff18bd58098dd9581dda73d63a34bd5362383de06d8679c3b848e803f4d815862382eb9f1fd87f9338c997f3ebb25d3f0f6e71f4c0e010dbcf8718b4dba

C:\Users\Admin\Music\NewRead.zip.RYK

MD5 c23ea70dbbf0d291f72524fbafd084a4
SHA1 c147246abc785c5808693a7d26fe6e2e14e89771
SHA256 c07419bced0616f1de1d6f9045cedab1658d6799e504846d21a17f6a69ac914f
SHA512 d4904c51bbd23b8fbb348e33227359dc69133ed38d517d9d0046d75fd0b6e336087f54189dd2a068a12256095dd223a70bc83eea3639b3400309496966a9e944

C:\Users\Admin\Music\PublishReceive.cmd.RYK

MD5 b0aa7c6d55aa8a5b220a1634270fc70a
SHA1 24eb30bb5e83255378f3392c9978b497f323900f
SHA256 493a9dd78100af52f48e813f7bd3f18ebe76029debfd6835049659d3be266c7e
SHA512 44d5abddef12d368cfd40c2ab92a7044d85975c1dc699297c0b3f121212540ec38e1d71dbd92539b976e4ff9c0d273edcb0020eed09f0f5f9d76fb4654a9b9f4

C:\Users\Admin\Music\ReadDeny.docx.RYK

MD5 1e3ab95718ae183df0ae97a69bc8a5c4
SHA1 25c0c41bf8e67be26cffba3ac96a3ac144b7ddb2
SHA256 cbc68cc4889303c6dad2087a5cafc1ceb235053eb44babaff1bfcb33ffcf20d0
SHA512 4b243bc1e89e8490ce867e1f50c5471f1065faea14975018e797c9c88ec6f766d9ccb3cbe3c507425187fab5fe56e824db0eb63bb57d79a6853ea125efd1e084

C:\Users\Admin\Music\RedoSuspend.tiff.RYK

MD5 08a25d1ff07f672e60d9a3094c5e46bc
SHA1 afa8e0ad555d870b8d6f00435634d1a4e9dbe491
SHA256 8fbfd0c8169d8b27553c32080f70796e2256bae9b943617e64fc2179a67bd35b
SHA512 ecd11728024a1fefb06f09f66e7acec595ecb1cf1706727b762c3aaaf6ed0bbb503e1c28cdfd4ae55e8bd735438be8440b4a073b20e24587727982a7fdadfa94

C:\Users\Admin\Music\RestoreStart.wma.RYK

MD5 6bad4e3485b5aceb624bd3170874d3ee
SHA1 741717524fdc6c3ac102a6cd27a24fde45f0c41a
SHA256 0154eb9dce56ecc3ad365752dca041ef63bfe8be756a9578b762233bea8427a8
SHA512 c81bad4dcd3d925de6a900667706d037f737e67af93198a9ffb1803f06a431d41867312b5b64519025e898979cedb2debe6d56c7108ee05c62ed74d1f2fe2f17

C:\Users\Admin\Music\SuspendAssert.mp4.RYK

MD5 1eb6fb662d7c22dd3217e0fe98f34e22
SHA1 efe76252ac35828a80d0491740347aa6490bb687
SHA256 862d3b11ba8d13711a5ed937030ee3795e5251e049ac81b03409b31a2f99016d
SHA512 7e111f36dfd04139c7d4d959469b350d3af86d99a7861a71e07d5e81da2a36b9494e4c4829680fbe0b73b3ffafe68b03cf89f6b31246bb252e6fe253d81056bc

C:\Users\Admin\Music\UnregisterEnable.MTS.RYK

MD5 8292bcb03f0acbc72dcada7cf19fa90f
SHA1 d69d8b6045087ebb9d5128214c28b8b9148d9e54
SHA256 75ac4c6300ddf7ddc3fd8fa29e51203d786f3909aac6437e365b7806678fe7e2
SHA512 99bb970852f9cbb19642683942c14cfb1cbd506c7c42e92fad02ad5ab7af58b37dca376896e45245db2884f5db0fdbfb4502383a77704caf7b9c2592d2ee0201

C:\Users\Admin\Music\WriteConvertTo.3gp.RYK

MD5 a2b6952ff1da70509f4feed193da2d6d
SHA1 10e43b3f0e7188ffa7275b8330c1d37af3a66f2d
SHA256 9d37a437d281c5a16e8474315c7169167afef0f97d1b39ce53549161177b5923
SHA512 99c09dcc7318e0113140caf0513212a46a1f7e7d809be0e2a01cbb88f753740f5180cc94e129401c4957ac7a5bbfb977a6b8b14a63af98318e7d73e8c20e49aa

C:\Users\Admin\Music\CompareAssert.csv.RYK

MD5 0dcf26087f4af74ebd0c202d4f3a835a
SHA1 85a1b81889af6647e81d7eb8083565da84b9b08c
SHA256 dbed2730bac13049c4d89cfe052a6ef4b4b4e16356123614530009c5d614d589
SHA512 16ee3e597db010f45079ab8d0a868845ad60d389d5bcba781170f9f71e516f830f2f50cc8fc328729469f516664fb4a78714bac0fec669210eea757e07da61bb

C:\Users\Admin\Music\DismountShow.dot.RYK

MD5 0955414c029960c52171763fec1c9604
SHA1 cb42f4c01d7ea8d52745567d2348345946829f2f
SHA256 24175da037e481c29036572ff7a1bfd1553d17bcd08e80d3476544f850f80983
SHA512 ff32f11c2739649b71e845b00786699216614e4b87e3b2e66452ea43be946e357622c1429e2b89229536d9441770639dc74a3580ef12db911d9ad1a0641a6bd6

C:\Users\Admin\Music\HidePop.asf.RYK

MD5 e4bb021134ba9eea2782ecf638adb182
SHA1 487a3b763e0548296a3c2d39041990a609ce0a03
SHA256 441bb1b978a4b6c6ffcfe618a273bbcbf318122167f21ca5406b760a806ec286
SHA512 49554180f38d4040ff3adcced874d62550cb49ff2d1f6c439122d5afee605710b3c0b842b6f6e28e7a59572c104ec1058fbb07b8d8b66baacfd0b33096dc3099

C:\Users\Admin\Music\ReadConnect.jpeg.RYK

MD5 3e23b81586333525a186f972adae165d
SHA1 1195760b26ce58ab29284257ebe64de3152dba4e
SHA256 3b132e3a1eb6ca8c5dbfd435d93ac39c49065f8cb0c330fcd2b182ce84a8da5e
SHA512 bf35750f564ed0333e963d208ca9c2f5b7f9675639442db6f2ff8c6571837420894ce1d9b2210427115641f536c908a4e28f28c52dd850fbd9c1007d932c8423

C:\Users\Admin\Music\ResumeSave.inf.RYK

MD5 454bde06a7aa3c92f1ad877ab1824d60
SHA1 a87a08e394e81df2270a29fcb98ea7d2577731f5
SHA256 83b0dbfbeea18781cb8a2e481c83a1eb22ca2b80bc87cbb7b864c4a3e851ad02
SHA512 db38fef2ea0dd5f3729c8a833d0cc4fdb6ff25712d193768210c06bcb373fec8a8a715126a4b4183df28d0b12df913cdd16f9ba2702e275fefafa1015f7a546a

C:\Users\Admin\Music\SelectSplit.mpg.RYK

MD5 2e94fa46298444908799f9f1d7aa28f5
SHA1 406c6133e63bc4124a8f39abdab19fc713a85342
SHA256 0c8b0eea5de804754fcc8e07e042ae3d3af4ac5e2f67dda10f8dc5ee74a8a477
SHA512 1c346326749afeecd3382bab162041dda0a709b802292b48bd4dfe3b79556465acf7ca523cc69d8e94701a2cc79d6eef4d1da5f141d92a0c916cef76567025c0

C:\Users\Admin\Music\SuspendClear.inf.RYK

MD5 b724f5956cb903dc85023659558cb449
SHA1 0626b803daf45cd1a048d2a4d8948472fe8c84de
SHA256 076aae81dacaeac33c1b1e1a756f410668d59585622623615ddf05962379e26f
SHA512 86638d151d142c891246766429a2d9c7db40e383e1cd34633a767607cddfdd2a513534eaad73cc04d401d0f208cf77fcecb5f28759e309e13df20cd68cbeaded

C:\Users\Admin\Music\WriteEnable.pdf.RYK

MD5 f6a4acd2b10e6ad5b43062c1a690d483
SHA1 09e90acb59eb5908e6f9fa407443ba08ba875a30
SHA256 a50d0e7067213f1e97d13203d1a1f0aa06b6321edad1c937e0ad32b402015367
SHA512 45ccb42e0c5c21bd8f24d3470c5cd73eddfe603fb44608c9bafdbe04b1bb6b086aa6abdb7131d3dbfc1540dbfab52e20a2a90333ae11976f59252b2b6f22a36b

C:\Users\Admin\Music\UpdateDisable.htm.RYK

MD5 68b97d032227e3e76a2edded54e1dad9
SHA1 4ff436fee01942e16cff4329634847c7eb0ac8b5
SHA256 14e07ff2f44286017d862d9739dc6ed7c1c1e7362033ac89128a38ad5b02426c
SHA512 c8b41ed146929939fd45c97badec7ce92ebbeb507a3ffc951a28c7128bd9a6f8f3bbb9456e06cd823e4addeb5400d109805373ed918255cf60a72a5fb5b99390

C:\Users\Admin\Music\UninstallRename.mpg.RYK

MD5 5394903251fd4abbd3fcb14e37b2d4e9
SHA1 8919831319b6c5d7549682c291acf0c5c8174fb7
SHA256 782b1ee9c52b25f05a81717b01d3f9f3238f2c72b5d20249a0e4838cdeeb54ca
SHA512 2f4d79b23825b3c83c35365ca777780884d849952543dfd2f4d0a36deed36f3e5bf906c02d3a8316482fa8481d71ab5739b91a639480b78d2922a52b9e7b27ac

memory/1900-10791-0x0000000035000000-0x0000000035162000-memory.dmp

C:\Users\Admin\Music\StopResume.mpe.RYK

MD5 a0228c8ea61e70de9c61eeb8a349809b
SHA1 8875bbeacdc0a577cbccf8630daeedb77a549f12
SHA256 b2e313a074a9c46157c9e4ade3248a26ac87f78a2fb5ee538daf8dda51d1eb42
SHA512 d416e09f0408cfdc11a665c0b73e6f67e5179e9fe73dbc5d5f9e22d6a186fe8b408881a42e61e67de3ca9eca03c190f1b6a709832a70212961133cee1fa4ba45

C:\Users\Admin\Music\RedoUnprotect.wmv.RYK

MD5 21a27de62f81aa9c0189146ad66fb0fc
SHA1 9d598695fc1e5e67e0c051a99245337a2d0289e5
SHA256 86e01bd84d81c8ccb6410def04688860a4bab80a47fc5a5e9ef24c126142ef27
SHA512 2a91d3a5eb419f7d7d831ff8176d3e7b558db2c52ae56b5e45114f5979e26d128964123a19efa86779dca0d52d15bc5272b8ddb51550128caa87aabfb41cad2a

C:\Users\Admin\Music\LockDisable.xhtml.RYK

MD5 84a04452c3e8c45998c1a17f4865384f
SHA1 f0e2d1a4ae900181c804e04efc915dbbd57548d8
SHA256 b5349bb5be1b6515c9613aabf51f33b44677078416f3ad7af4c1c2d450104b00
SHA512 20faf89fe38539a69e1de8f100beda3248557f14f390625330ad3f8e6869e0bb359a541654eb7aecb9b281851f2e3b1fe2d0f4921cec37eaca984b34df8750e2

C:\Users\Admin\Music\ReceiveSwitch.xltm.RYK

MD5 11dffe74f72923ae1982d14bb2e68147
SHA1 54c9a2f1ebf2fcab908841a6cc3883534e566686
SHA256 39cf72fb24221e33d9564b79cc44774476893fb4125e580b94ca00dfe59bcb68
SHA512 2d99d74cbef4a77791cbe151ba833fbd269d9e72a2a7c3297a58f4b30d7b50561d33dafa47dae8494277dddb04878c3021f6d0f5f616a92a38a6854a83b5fa7b

C:\Users\Admin\Music\OpenSync.wmv.RYK

MD5 e16a69a3d1153328973d6f43347a6982
SHA1 ddd9fc499a17c49ebee9f670db444b34ae2d8d6a
SHA256 4749c83ab8e947c6f36b38ea90c84f133b1c1b8bcec57a01b492ff920369dc3a
SHA512 2e7bbd3f3b516c78a2bf8ca40396cadfada8fcb0ea4f632ef61ad729e6522a0794f33079920c83068a008e5ec1f99a2f9be89311f75a5c4d00f3f0590d26dd96

C:\Users\Admin\Music\ExitSelect.emf.RYK

MD5 d0789f1b13e57241cfc171301cb1c12c
SHA1 03da9c7341d786b5e30119bab175b6ba4c5e3ff8
SHA256 c40ab1bad00344dfe2545739b7e4d067a14785b185797e507c3e62fe0f136429
SHA512 237617febc9a5079d04b7ae60db086a1225f0c6564970d016a370efeb8e06dc003de682adf2563e291c4d05452bb4df76e131aab1f25634175b0f5c350cf5c55

C:\Users\Admin\Pictures\CompressSwitch.ico.RYK

MD5 b0fe163410c06f975eecf9395ff248b7
SHA1 959ce3db49e39f5289f0bc4e6b1c97270c811eac
SHA256 6f752c0b52478f4208e53629e5dc28524674500c7d3822d46776635cd0e818e4
SHA512 f80ae03167965722c1caabadc630c91a13c8c2af64e0b8684c5b3acb8f678d526b1321f553705a141931fad32ca01d3a5079d726b2d2134ef7f33a3e737d40e9

C:\Users\Admin\Pictures\DismountMeasure.emf.RYK

MD5 167c79aef914badd4c0884fe90757234
SHA1 ef0a5e30beb8b14aac1d17435a87d0789b60f98d
SHA256 6f77d429210e54e112ef7ef5cd4af9c50f10bc48f9b00483c506feffe71966e1
SHA512 d7dc8dd03bf8e37bfbdb8c2cead40235f941b91bd9c8c434572ae93a9179f3f12a518888d8e98bb0a246e1c54456eebdc6093142049fc528a3f6606482ed3f6e

C:\Users\Admin\Pictures\EditConvert.gif.RYK

MD5 14dffa3355579595ecc42191363476db
SHA1 ab5cb91458eda75f736d9182f83ea3e24bbd2564
SHA256 9c8588c704f6c995c8c46a90e33f6b2ba8f3afd5beef474710183149f02ffd22
SHA512 00fc3de0717e8db865c9323a02bf7fbae156ef104a14e8bcce2b51ee50f1715437affd9e60fe113f9b5c4fc926e1516e3efe6f0723921dd39ffd738e9ca2b99f

C:\Users\Admin\Pictures\ExportSubmit.dib.RYK

MD5 5e2cd9fa8d1d0926e82a8558bad60b38
SHA1 da3c964670c70da1421ef48bd8e408c47128b2dc
SHA256 83480d168e4f31893f616b47a2df142bb580af72e52c87544efe84264550e29d
SHA512 a515d5d6d0cb065853d1befb802580616ed8729c0cfa8f6e5daba300214200547e8c5f918d76e0dc7eb1a1bb58b0555a70fe9e4d1363d932708137c8b1dc8478

C:\Users\Admin\Pictures\ExitTrace.cr2.RYK

MD5 e479f808c34a7b4a0f9d9783c05d1765
SHA1 bde69e9a97879bd77e30454177ad2b900400487d
SHA256 8f35946fb38a8ababcabe8504f49fb2413f2fffb53d365e10ef5e8e79ecdc87c
SHA512 523dc6327aa68a1a1c7599f78753de051fd2848e3dd80e9ff2fbbcac2b3c86ae72a3daf398bba937e2c0c1231e659dac87f2415cb8ba1f27d571e07a90900785

C:\Users\Admin\Pictures\FormatLock.tif.RYK

MD5 3b435a78679dc982ff0161d5b4def9f8
SHA1 ec5d242a9b17ac57784a15e7d3918477de59ba77
SHA256 789cc8c9400476eb87c62fbd8cc3ec9b8f2a29a1d29cbc91014dfcdf3d5713ac
SHA512 66dbff34b9a6b3df06bc30fa336219d5267625ea7bef76371af241d09c766d3e22782a917fb72c13a16edfd2b5e4863c12018f8bb56069618258930bccb311c3

C:\Users\Admin\Music\CopyConvertFrom.ico.RYK

MD5 25af820535269ffc1c33bb087bcdec88
SHA1 854ef3dcd8673c89435c03397344d3ca3fbf2530
SHA256 e034b217c486607c1c5865de57f3c25c1c05342e88d6eb5e5543c769b4f06fe9
SHA512 a06a296063f8bfb4c3aeb0cf10c9c4e33deb9916061c872ac20fb67cff09c93e2bfecb1d10543081fba28ef17989ce4fc2ac150762476758ab0a440b1521c42c

C:\Users\Admin\Pictures\ImportDismount.dib.RYK

MD5 2b776c1758e94b7f47692f3a847d715c
SHA1 44616a8ddb21f9343c38fa2af367452d3a672aa0
SHA256 085aba27ebdbd982d710ccffb90913647dae2665169fa10ec9c17d7677aff2a1
SHA512 0cfb3c52ad22ee8034eba3bfae5b85a371352e029cbc849e5ec352fe459a76b6a284c499035634b6a20f2e4e60657f249be4d61ad1bc76444db5d86bc6955672

C:\Users\Admin\Pictures\MountTest.tiff.RYK

MD5 d5979826fdd7b6abe6a273b75bbc1f24
SHA1 a2c9cecd0e0a230e6a8983ce133ee405c1db1045
SHA256 1cb527834461e2badf105051e1567c00077b5d9a1e894fe2d9ec0050bbdadde5
SHA512 6ab85150ed8ff36bde753aca3c7bef7d0aa11b585c5f1d1235f3bd33d82002a24bf894896c377a44cd4c9554034984d800a920e2ce8aaea4716d1cb10929d2be

C:\Users\Admin\Music\BackupTrace.pdf.RYK

MD5 5be75ee27cacba2ca99a32021d40ca71
SHA1 4d32a7491a6e29454d9216a1a8f82a17df64b86c
SHA256 3c96b3e45101b0c4ac60279ee44fa97d39dde46ca010f0c290d505f7b78c0f92
SHA512 9e979bf4fa3bf53e495e8e387b63834dfed6a91aa9cd8c8f94095e6bfd98b19face35648becf67b27cfc1a993b6a40089b0988549633b3547642bb725ab68d87

C:\Users\Admin\Pictures\PublishSave.pcx.RYK

MD5 f5ee77456d267f8523bf0fd62de53f4a
SHA1 ff0deccd90acb4030bd8eb2f03b95bb1948a2e1b
SHA256 5868f08087e464b5f9915585a32b79c92d7377f84182c277ddf7ed5aae9236c6
SHA512 28c504ad7323080b7c0573209fdc035e7ad191ca1fc6dacffa286e917821781418c06db04d58fc444f641cbb74ac3860ed22a1cf60b4d6150f02a6fa01ed732d

C:\Users\Admin\Pictures\ReadPublish.jpeg.RYK

MD5 e21ebe4452d36a7bc5528dcf92a8b9ae
SHA1 3dfcb7e031bb0a66233279de5f0388622bee1da8
SHA256 1f75dac3f70fa6352d0867c8c776f875a40fba397bf74110c2fda47d89a17e7e
SHA512 bb88345f96fdb842a038f89654f83ac0237d409b623f0e205bb2a14fed0b9781de3fd1cecc31670a892852c5136bb77542480c76a195b16d84e5d5dbaa142328

C:\Users\Admin\Pictures\ResolveRedo.tif.RYK

MD5 74131ec944f5dc084cffdb3b782c5920
SHA1 a3e5919bce5d056a89ca2b4b06d8f2d205cce786
SHA256 f667d0f08cf47cdbba95555cf591b904d89bf352007ae8a66dee70403ba62aed
SHA512 7884b563ac4ed3d039f53812424907dc0e95a0eb865e02ebac01f021cb6d171a47107481cb54d69fec4a793ba0a69c9fdb79b2177b3853d0b087c8ba6e45de61

C:\Users\Admin\Pictures\RestartPing.emz.RYK

MD5 19bd2f6101241d14a7bd655ec3429481
SHA1 6d175910151b25bd1b747d139c437d5066801358
SHA256 e35a84004615939f5fa0a6a62c15279f71a0c583f73842b54744c9ce3ce9ca6a
SHA512 5f077c928fec0ab722d8c69758df7d1edfd264b84cb76e171f82cd3cbcdc2a3f5678e847d5fe397d6070c2b95f610ec7791994438581c0d4e322edae8e917102

C:\Users\Admin\Pictures\SetWait.cr2.RYK

MD5 68ffb7105d69060078ee266bfdde5589
SHA1 410ceace52d6d89c68c22962a391c5bf2901046f
SHA256 736ec752547d274e2c541b499ae1760df15f67a3ef53e69e502fbf08afffa341
SHA512 441aaf98dcbcaf80abe35741fbee70a3e72661aaef48e5141fad686a7720d7c1343745f81205eca7f8a4a6373135a911e5f8df844313f163e250f8c7bb8a519f

C:\Users\Admin\Music\TestDeny.TS.RYK

MD5 eef0f761df34716d6bd07893fd184562
SHA1 b2c9c5b4193a4bee7fe5fdc5a784580baa1c59bb
SHA256 c13a3887b3043e672a6cd32f1622f7d78ba5c3b42e3c65f498f67e0fd07614be
SHA512 ee40e281e48743aac71409d849aa2eb51b88860d08a4b035155a6fc2c990035049d9597dfebfecc3fd570d295dca4e50343356c6937868c8294d9674b907fd70

C:\Users\Admin\Pictures\StopInstall.pcx.RYK

MD5 00282f22fb2b840b9077a50d706c4185
SHA1 22d240728e6fab5044a53ac94b5dd71aef0c3e2c
SHA256 005c058c5ed809d17e93b3781ef877031d8818a64acb8029cd1a2e52ee9958af
SHA512 a692c1f504ddf4a112c67264e6cca9fa6cacbec3977a545daf7474bd90fe6d4d8d8ce084f36ee09d28debc9d21f3f29e49f1178295ddefd6255c885b88904f07

C:\Users\Admin\Pictures\SwitchRename.bmp.RYK

MD5 c0f9046230f3947e0a2b426ea6e97ff3
SHA1 fd02891e83015234c094aa3cf397150aac9bd255
SHA256 74d8877875d3665ba6fba00870e55a068c39ce07bf3d7381ec81ddeecfb2438c
SHA512 813a1b049427fd8b5c39ab5165b630e1beffcae9e1ca5c67d22ccd26074e210d116ec42bc2bf81c9fa2675fda5c184923a47237ff5fd82571a635a3fa5d3e3f9

C:\Users\Admin\Pictures\UnblockTest.emz.RYK

MD5 0469a34f8dc89ae9b8d45330ae43cb23
SHA1 4dd853bb69b5631c2d9b8d0851301a4a040fe572
SHA256 3730d5f75b13e7a684ad48a0de2bbc9a479f84c0dfb1f86479406abc03d747b8
SHA512 6b300c021e58becc38265e62b57fffb86edece430527447f826d6c00e4493c8ed2110669f31d744ed728fa8a3c4f69667e931d28b6b896818e253a712301b228

C:\Users\Admin\Pictures\UnpublishMove.jpg.RYK

MD5 ae8b873479f299ee2c100edf5cb3f95f
SHA1 36ba47ffca84910dd30a3ae412fd0ea5bbea6edb
SHA256 8ed8e292a2f193b1cc7fcee0b71449c0592f9808f82d9441b44164d8da2d2b60
SHA512 2245ab717f5452786920cbbc5390ccdfadffc4e8dade4dabff1ca3ebc137a7d5874e971cf536230f1d6d3e04effb3797ec90a15c5fde0e38b9fe4886fc030eb8

C:\Users\Admin\Music\SendUse.wps.RYK

MD5 d98416cf012bed81296e252adcca9117
SHA1 dba9ca6c8999741ccfca3667b4f5fc20b19d1dc6
SHA256 b85d8aa338e9c3ed432ed632308642fb238f31458029b86fe19ea7d7d600ab93
SHA512 a83a50461137e157513d8b4dea97908ccede98f76e36e9463b62d8e6bd3b3d729a98d7c2119d76eb6626d12e1758cc4b5448ba35cedb364274ef104ce0bc6752

C:\Users\Admin\Pictures\ApproveMount.svg.RYK

MD5 809a847a363f48a969bf6a5b7d5343aa
SHA1 b5690eb0e074792968aed2d383ac2ab0d3468fcb
SHA256 b3b2c9e7b66e42ae809534687e2795688bdb801c5f784f1adfd84535a9e6bcd7
SHA512 384278130ca45adfc0247c79a88bb797d4699aedb35ed82922185295e31a21c3eb4db26d0d6e84abd109a3a1e5111b142d1b5d5b2e262a5dfff836a6c645528e

C:\Users\Admin\Pictures\CopyMeasure.wmf.RYK

MD5 e0cd7d13820480215de526141547f835
SHA1 52e1c487991f243bae76aa504876bbffff795c3a
SHA256 cc47c3fb4d6e6aac9e8f9f6aa9259093ba207589f1be8607c6e5b2078a6eb0ba
SHA512 d04982f854fae74b70482b32800063c2a30810d73fc695caa7f8f047455ccd9758348cefc8e008e24dab1bfd018d47ba4f4e4201b2ada59dcec3f344198376d9

C:\Users\Admin\Pictures\DismountSkip.svgz.RYK

MD5 ad289931247b2e0d7a66368ff50e05ab
SHA1 6e83ea1bd0e196e58d977bbf60744f144fed7f7c
SHA256 fa885f54b70baf617b4bbeeaa5f82ac8e71bce2a404798ec3f3a352ff3bf0942
SHA512 7a2fb731f7c533a113c8bc03df7dd6c4c431879d7f348eaa1b682e56891094b043233ba6fa0c581a64fd881fb5d76203bf51f0afdcdccc0275049a940cddea60

C:\Users\Admin\Pictures\EnterBlock.eps.RYK

MD5 676eac7827224df96588a03360a81e11
SHA1 c4f81ef2e86c4aa1dcd4ba1b1ad1be4f10f9e6be
SHA256 b41998428cd61a9047b9732054bf45bdfd12916b072042148ba9bf784dc01288
SHA512 2bed5eb5f8c3cc97e4af1e24422160d011babfcd11829fb0b5052e8bde7d615e1ac1516a2e1fb043d0f4830d387cd33844f6ebb1530dd608f98fc458675d4963

C:\Users\Admin\Music\SearchUnpublish.3g2.RYK

MD5 80e90f77c9ed0421312064b036189fd7
SHA1 af65b384ec5b0bc63a1a725e3573ffed1c597626
SHA256 2a881336ad7e7a1e3b8da1136238ec3d50fd578cfe7015e56848ba05a7bcbc65
SHA512 df33aafa5cc9ed654e32a78d2917a8efb66cf4d87810a243f3f163a932e89e86e252842472ab4d322fe02803e385117eab7148f26d015a18868943ac4bc239e2

C:\Users\Admin\Pictures\ExportSync.crw.RYK

MD5 49cb6f51da1d57981c46ab99ca53250b
SHA1 83afe42ccf19da6666cd4f9e25d19adbcaa7e21b
SHA256 e471fea141c5f9199954ace45d798414d48b0b545d806467d4aacfbb8d6ab499
SHA512 09a50e17776617ef18b5abf5d8daaf96e62948912080c0694967fc9d26ccdbb0ad6882230ae03e23774438aafff3bd0a3febd96a0c0aeadc7dbe1a4aefdb53ca

C:\Users\Admin\Pictures\FormatStep.svgz.RYK

MD5 7174250ae23adf9830f4be4d8903a90f
SHA1 090542e15cc32618178111c9d4e9c695431e868e
SHA256 53522d2c0b835ccc589017e876ca5e7782c64530b20618c879c9f86573e93cc9
SHA512 7c7bedc5c086d933ed35e2e2c4c5880e8092b876996c6c8f893d6dde25cdcf787b0f63f480138d4a5bc54c411b383e0869d3cf8a76a9a7cdc8051cdab91dad49

C:\Users\Admin\Pictures\ExportInstall.dxf.RYK

MD5 e00139950371f18365bcc0f97f392625
SHA1 2de7ae2e3084a44b50029b9beb5452deea846d7f
SHA256 1845424f42ff7236ed5a6e28318ced9c5d1b6c7104d91c9e9e5878e22d06e6de
SHA512 9e7bf7e4481a6e387119b4da5e06c002030fa57bb3107038c22915c155ff3128697851e138341bd7ae16570334f399a060705c317c4bc9a3c61972b3fca644b6

C:\Users\Admin\Pictures\ImportUnlock.pcx.RYK

MD5 cad43631c56f739e37d4feb49c71cdb0
SHA1 04e6294cc4d4c82c12cb62d4379de9318fe9a47e
SHA256 9b214d356132f04c15283ee027734bea52189ab8836f484baf257e33cac56111
SHA512 b6169e09c11c90be734625f388c283032c2514aaf0a00ca763c9b7e196296a233254a11882c455fc4beb32b7dfc6f4a285713c258065f2aa5957ee1708273c4b

C:\Users\Admin\Pictures\ReadInstall.tif.RYK

MD5 cc4c42880bd4782577154c07cbac1cc3
SHA1 30fd4b570b823be64b20a83864d20fa532abf77e
SHA256 7a802fc349f5170510f955ef6cdd4abff1eb54c77ee6714f8dd238ad40f01c8b
SHA512 ef27f9c81c8a8aae9abcf1ad4b67b1170393c2942bed33781d0a951f0c17fa4136bf442f6dfcc2cfc68f1f5d51bdafa26d025e39a802a9101668916dfa967b14

C:\Users\Admin\Pictures\RepairSuspend.raw.RYK

MD5 63019378d1e58cba3e1aafcd2bea439d
SHA1 8516b2ded5f203193dc1a5b450a6292f9ac723a6
SHA256 f80c0be1817cbfa0a3ef769a27b172abaf6abaf9e22ffbb1d86a5ca0806ccc6b
SHA512 083fc18bf2d8df1cf73bfdc42519d2fcd2f83dddd8fd2e61ed047222f000a6b347223bf6c486b73c21d4198765b6e1e7454cfe8363bdcc686ad3d8d9d74f3331

C:\Users\Admin\Pictures\RestartPing.dwg.RYK

MD5 1a9f2a992db5e7c71b7779a9c2319c77
SHA1 aec4e4fdbae4a22daf37d54439cc4c8c8857782d
SHA256 0558188d564fba9814998c8d6d3074d8120ddaddbe4794d003ac832546c078cb
SHA512 7e02c7f5c0bed2094d014713ea22a5cfc3191cb30dcb0a7676d57506b9c327f1e1a57a24193eec038afe29487627f34f6e04334e63ac46539d6dcc5b1bd06a1c

C:\Users\Admin\Pictures\SelectConvertFrom.png.RYK

MD5 5dedf8d16e0d9c4838b7ef35e1001984
SHA1 059c9335a40be01a6e81c009c5533e1fc5376c9b
SHA256 ec646d5e35656af78f1ad34d04cd980bec1fa1e2476131db150e6ee54f83d394
SHA512 32fd01d61eb6dbf8a72cf1fe64a23a0d94f57a78e087aa8327cddd74a2c622b72f9cb770c683a958a3e9fe4cc85d47f6708d24100454d0855950b5a54cb7aa14

C:\Users\Admin\Pictures\SkipProtect.jpg.RYK

MD5 13939fa69e7149d30c512954b61aaf99
SHA1 cc3939005ad44ba8f5ef71bf10da59798e06eb90
SHA256 6faecf61484927f75b86cac13a2db029c36a4533baa6eafc224e43fe284dad8f
SHA512 8ebb6c8fbb12efc78697396d58db6f63a87b6f73c3e1a16909f5db572e09b6693e74d1fb60bc6bde4adbcc1dad5cc278221ce5086aac85734318d5cfec46a342

C:\Users\Admin\Pictures\SubmitDisable.jpg.RYK

MD5 8eee369e3f4ffc06746ebb3be1a12105
SHA1 86aabea72fdf6d1b49962b103204c752b08398a9
SHA256 105039e227a04434346cb21a42e6d08905b534398fe6a9d90d7efa7e52713e4f
SHA512 899b50263bd1b520848fe3cf875b6cf1b20d53c5566f543e4265e1dd8e9d2c037b0ef4511ab2a00818cd90e17347357f5235db226513dcd149f4d8929909d0f1

C:\Users\Admin\Pictures\My Wallpaper.jpg.RYK

MD5 9552e3592a75d6570d24ef9093fae7d9
SHA1 60958bfe7119294ee50e3b9f24160a8018e12c41
SHA256 822bcb34ddb937f2cfb0ed9ea1f2824f9bde9d41c82b50314dd908b0d02f52bf
SHA512 1186d0cb9cf9461113479e29828028cfcdb290aec32638b1bbbebe050ac67fdc6109f223bf5d8da89bbd208909c48c84aafd42d2c96ab3cf5c295b4160172259

C:\Users\Admin\Pictures\SyncEnable.png.RYK

MD5 95d306be46360e36e7f00cef2e970bd6
SHA1 57683bea8e13651be9333a69b8802986c3160333
SHA256 73b2e58100308b42ae3c874de5c9af3f78c39819c70465dffde00f856819b0db
SHA512 1dd5dfb3f878bbad6b4fbcaaf084c5e1abfcc8476e3a49f5aa6db7f771a0e37b49b8b1fd013163616347516fb862bdfd4a7f05aed3174a7ae424a06bfe60b754

C:\Users\Admin\Pictures\UninstallAssert.png.RYK

MD5 e3fee825d36c3adfabee191e4b53134f
SHA1 f2a07ba6ad2c07adc7a99952c5edaf76ce7e7b4e
SHA256 429edf82c74f4234e9ce83ae9b0aefff25a9221dbe8f3063dff709cba00da1ec
SHA512 2c1e96df26477912823efa95f496b98f1cb7904b1b90cde901797529fbf6c3c3181b7df15d7f2005d3e6454a43b2220be619eaa4a6854bf5ddddaa146d74cf3b

C:\Users\Admin\Pictures\UnregisterStart.jpg.RYK

MD5 ecf682a655849a316741ec3f7e4948d3
SHA1 7e01b6b7c3af4eff96a306dbd6e617315f9b288b
SHA256 15c253501b0325017a0e3f74f2726a6cd5eaa800070bc5e1b266b68557579aa9
SHA512 fd8a0594b1b9f8c1d86b525e0832cf2ad9d51914d1515febd59a075094f6e3058b3eec37c261ef4f9b535bd42c7e9c26d929edc3aee631261800463cbf1b81f6

C:\Documents and Settings\Admin\Recent\CustomDestinations\337ed59af273c758.customDestinations-ms

MD5 3f1ebabe9cdd9b1c44f0fb9e9ce91652
SHA1 24949a6e318b664d179690bb7300f55a7de1b1c5
SHA256 4ae102a8bf8ba0b07e3ca00b31cd985ab07fab598d1f4ab93acd87f3ce86c8fc
SHA512 a4e5afe61d5e6026cdc5c3e2008d315d2b2283c5c1bd4498dd5dada1585d592f3ae3b47ac505356268d90c962dc3694ae16d12989c7a54ebc8943851fe336111

C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata.RYK

MD5 b4c1a5f549048e6b877db429451de15b
SHA1 c608ed7c2ab15dad3a4085755c055e3275ebf8bc
SHA256 53e155b7dc34667999f449569270bf5a9c784f99281f1143ba617851fc629a8a
SHA512 ea59949bb705986db6e444df11be2f620ddfbcc8878c323dac75106cf42d6b1e24115be1fe42acddb6d2f25e6d0a00e2f29a88af826cb053053316fb41ef5252

C:\ProgramData\Adobe\Updater6\AdobeESDGlobalApps.xml.RYK

MD5 a0ecefc67ac376d5df3895848b2c43a4
SHA1 f89cc575cebc27b3f01d1ead4313978bc41a2275
SHA256 1f7c4406e517db94055488f64319a06217d7045a4203ab7ac18fcc50fcd6d15c
SHA512 93b35683a8139d7e9c0ceb102195cfb3736b7ba093f10c6cb3ccd4823f76413ba541f523bef133361134158613efa4cb1f40344ed1916eeb1583f66650337944

C:\ProgramData\Microsoft\OFFICE\MySharePoints.ico.RYK

MD5 11d8706033117020d0012ecf6c9ac028
SHA1 4d4e981856799fa7f15c4842a80293a64bec9f6e
SHA256 978abc61952d5edec55b5dd41568b27d87911c70d835925f76c1280fa9f17dbf
SHA512 344baa4bc1c8792d0a93ef5b627abcc7b5ffbd133d4e8238543140808ff7d6bcd932cb1c10f64b056f7a03b7b43235d370a01dcc7d6b8ac01356bf5f3ac01102

C:\ProgramData\Microsoft\OFFICE\AssetLibrary.ico.RYK

MD5 80f4a42379da66329071c61d732e65e8
SHA1 8368ce76661d63960403fa85673d2ef3526bbe41
SHA256 b304c59e0b06d0c22d7b14da9c8270812e6dd6b0f902358816433f2214b81170
SHA512 10f8c55e0cbe4f61484f7b634d8a1d827baf9281037b07e43021c365ec4be587cdb72eda57dc952d90c102f0ef5995dc40f82540a7bdc04425f5267ded3daafe

C:\ProgramData\Microsoft Help\MS.MSTORE.14.1033.hxn.RYK

MD5 548b14ea965be682597b06bc97d9c786
SHA1 d80c558c7a29c62762f7ed694e71e85abdef77eb
SHA256 5efb9140684e00a464feab6ed1a411bbb4f812bd6b22556ce167271f81968866
SHA512 8524fa9edc350927ab2d1fd7e47832a7d3d095da3b5d96a9fbe19815aa956060d5ddc99719e379f1908e3e136d8dc9e9e7a9e4536c80013803c3184ff1253a70

C:\ProgramData\Microsoft Help\MS.EXCEL.14.1033.hxn.RYK

MD5 2baa0da634fc7a40370c1e21f084a3fa
SHA1 4f9363c3b5e5bbb28404e02d5452c60410f428b1
SHA256 17ce9e30bcc27679407059db5ba300b8c1cde8080535ed6e71a8fff466b82005
SHA512 102915bd2306da4118e16d69cf19a5d5d6daad198ae2b603e8171cfd9a2cb84f5d878365b39bd9bd4561988125663c1635bc6ee5dfa7910e5c23136ea408a66a

C:\ProgramData\Microsoft Help\MS.MSPUB.14.1033.hxn.RYK

MD5 2963fee6c2cf8a78d2dc4776f801b4fa
SHA1 e8664e7fcc338a5a0bb63eefea1659925febdae9
SHA256 d59c4d58c51f3c9f3405c30df63d00cbccb99f9505e1738c8728d0451b70f500
SHA512 2d121097073681f248a9060b49c1f7efa5e09a7d447ca068e230d9ae0738f13fda3be360871b3800914cd57bfb49c74e82b0a2584e58108b80699ddbd1c8d361

C:\ProgramData\Microsoft Help\Hx_1033_MTOC_Hx.HxH.RYK

MD5 e9641ca91f8ab0b09bc9e3b2dad125c0
SHA1 15defe257129aeb0c459da5089353f65d60140cc
SHA256 67a9020efc831f9184e9293ee26dfc1ebabe1f59753ddb1b2c3bf592d59f56e4
SHA512 cf81e5db4973a78da82bbcecedcd16b842f7d839ca61a5ca48106f11409f2956d72983ae0570ba65859823d91b85b7dd83d23b6c114dc723873a025ec34ced1a

C:\ProgramData\Microsoft Help\Hx_1033_MKWD_K.HxW.RYK

MD5 f4a763c6a56dc6cba774766a2cef2322
SHA1 5182ba69ae9e9419cebf0328447b079f1ea49337
SHA256 28923e296f45ecc0fdf4d9974549bb4b4443cfc9701647f16a9adb5e7b099b73
SHA512 f25b23a0d7f0fbc477ae55cfd4111207f5c2d0c2b0913ee2fde8961238ab07e22437db3dcc79d383b985ce5bff0171a9d8c11d49fb7a45e797da19b1f9219613

C:\ProgramData\Microsoft Help\MS.GROOVE.14.1033.hxn.RYK

MD5 4af99014537278ebaefa2b3788555623
SHA1 9af1ad4b03354330809dcf85692761c7b59ad6bd
SHA256 d432a571372e0248f448da6b026ddacd631b651254b95ba48b7d9a8f55c65382
SHA512 e34426e3c78fed6ad67bdfe18cd7c0970ce588db836f7bf2945108e9215cdd1c1ce903ef0a1b762df66db40990284713f86579a344cb58d789a42b5a99e5941c

C:\ProgramData\Microsoft Help\MS.GRAPH.14.1033.hxn.RYK

MD5 8e9161abfdd26aeed4e09f9007bf13ee
SHA1 423f4d6644bb2deac8295e9612ba03f1fb1801e4
SHA256 4298ce70fd6dd229202ea56daba93278300783732ff20d2995403bde65dca9a2
SHA512 f36c96b17559b316d15daf2f2772a01d18cd09180bf7f161dc3d5a45781930dccc221d18f07e0e571d907ea5a6d1a3785b08bf8f7b927c53d33e0b319ce363fc

C:\ProgramData\Microsoft Help\MS.OIS.14.1033.hxn.RYK

MD5 f6bf7565c9cfcec4136f2b4c7a05e68f
SHA1 648d94e93c801783be19166b1b1ea6a4a2bb57f2
SHA256 55fadc0488861ddafdd4cdab5f1c64234bb052922083aa13148c5381caea7741
SHA512 ae50fdd1068bb90bb7c5321b6ef4c97e68c15acbaa0c7ee9d5e51694cba2d0a04d43858342383bbc66e177937c5d07f2080ff3623789560453ebb49947ae1947

C:\ProgramData\Microsoft Help\MS.MSOUC.14.1033.hxn.RYK

MD5 4646b38253198077a47c7019e50a1a84
SHA1 900cd9b6286f42501b71ca3397b22e3fbb7811ed
SHA256 1a5a20be09127eb9b616bc4fa2465c1d761c5f3f115f944750ede56394c5ba4a
SHA512 acc5696c9f78ab271be86d1afe7411e6dcbba10757dd83ade372934ed9619abf19676fe5cc42bbe81190f35afa7d65b155390d8050706850b6b15d24c9a12b5a

C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg.RYK

MD5 04ba2fcec5b40fbc9aa2e9e7e2ee6aab
SHA1 3351e2e37d4f646fdd68faea505fadf6ec90c5b6
SHA256 8e46c945284784ba329143cfd3a3a2aba9c733d6ffd899f959d508cfd58d27fc
SHA512 114fdb33689c44edac2b658d339d715eeba361dfd0f331fdd345c551f2d47ef5cd35910d2aa8e1b16b9ce047a320df94783c9a75da88b59bba28735486c1b25a

C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.RYK

MD5 8b37ee9e18e753ff21bd74fdd309768c
SHA1 da0ab763004b7895798df9c1806075615446749c
SHA256 dbab96431aae39a46d392fc435c5cdf88ba2e269a3085c1856eef0034fa6e387
SHA512 c92f8fe9593da6667897afccc725ae433a55b02228790dc561835a9bfceca7381a67cd5dfcadf553a64601c5658640f563d5dfd83f413bda23c1f85d7ee8e926

C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.RYK

MD5 c156a1e190a23584fefa71b610938e44
SHA1 778cd857790af4c8939cddf00c1b3b7b30dfb7a8
SHA256 934031955dc462ae3a5aa8da0529e6877ef3c0cf340fda606964068797cfca46
SHA512 9aae6f13ac70c3a7a70533bbdf6aa0bf226eafa402faa6c015c706fe65202f317740bfee6367759a79fda6fb238c1eddaad45d1b1bbf35b8901ce10731358dfd

C:\ProgramData\Microsoft\MF\Active.GRL.RYK

MD5 94f7a6fb898e889162cf45c380e1d592
SHA1 3c971db3da5339d08eb7479e7ef5dc7bf7044e17
SHA256 ff504569a1d370428888c4d17e62fea1ce37db0901a3c9d771770b6c254ccb53
SHA512 60f611588a643f5e9055c62f473367a2d809044447dda6ac73acf6da9d3c8080aeb870713d25da51d29ebc73ab0b7bf8601c7be0f0c4a72b76da6a07c56a6a38

C:\ProgramData\Microsoft\MF\Pending.GRL.RYK

MD5 fc40f664b7c161d04d7b40fb4ab4600c
SHA1 523c8b67369bc72872dec919fc3bb9284faea7fc
SHA256 fd39d512d5faca71dd7d25484d14c45f3b2563cc349bd5127d3212fbb9bc3553
SHA512 264e174ec6109fac09f9fa2c8fcc4b49fa97bd7fdb954b177ab59dca01fb637087bcca394e6b63f38dd1ba5580c869f5cf7daae1cb27bea2a2b69aba00d43379

C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.RYK

MD5 cb7ebdaa3a8daa2a1b7fed83e33847a7
SHA1 16e55d95a71ce4434b999ee547f9ab5bcd16397d
SHA256 c6f79d1f60ddf4c824ca5c7268d2cc0ea26bf2e83b2c42f43092f26b865855fa
SHA512 207ffdd29b8adbd46d0295e1f09e82b52362b83f6dd6fe64e0e5d6ccb0da7125bf610ebf50522fc42d5468861f0c34edb400755e0539bd3e6fecd5b67786f99e

C:\ProgramData\Microsoft\OFFICE\MySite.ico.RYK

MD5 9e2d64c2176c2c1da271aa2b94ab14be
SHA1 401e95d33ae391fa6ce411b5e38135254190fe9f
SHA256 1cdd47f81d1f50a33f7ae85b045782152a03387e9d3f96b3f4e78f76d75b993c
SHA512 39ca66cbfea40df896d616885dc26dbd26ea311228ed0d17e1c58752220c0792fb22e27e562719b5d7de518479bfff644bf8259d05445fd4c9370a3da1443a0e

C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\tokens.dat.RYK

MD5 68048168495b13d5b03b9539f00c65f1
SHA1 5abaaf505dad8ea3eba48805663ce275ffd2b31c
SHA256 ce939623d0b525be57d2da7043ca649d04020029559770c2352317a7cab573b9
SHA512 e32517d0748f2d6b64677b9f6f1b5b114dfa1c4ec86c6bdea7b18abcef15624d87d6db15103b9cfba82fac413e0f45d94995396712523ccfa2ff1ab2a9e4d9a9

C:\ProgramData\Microsoft Help\Hx.hxn.RYK

MD5 415fa6bedc20fc3ddc951e7a168d5315
SHA1 56268a7034c0ef4cadc8f94fd6d9f7f137aa7b93
SHA256 a74c970a5dbc78ac8cfd2df950e0898ca7022dc9ebee8992edcf0518ba750990
SHA512 93d3c5ca958914001a1d2f55ffd295f5457110c232e25fca1ea1104d49c936b824078772a714d2919d7ff4120501342aaa14aa273a5fbe1c6af15592d9bebd15

C:\ProgramData\Microsoft Help\nslist.hxl.RYK

MD5 c89260f96065fc42b12136cc7c63f9cc
SHA1 bd9b9fc4c79dc67cacfd5b66746f733a16fb376f
SHA256 05b496598eb768a714714f8bdfe36512d760a309fd61d30936ae9806fac4c0c7
SHA512 49f6f69d89193c0142a185ed8adbbf8d8b0f4ffbac5b1f66fe0b93e998f532eac4c57bd69139b24e19231dfd418db6b130ece49eebaef1c81e780df62d4411bd

C:\Users\Public\Videos\Sample Videos\Wildlife.wmv.RYK

MD5 56aa864b904a3302d961171613f7d57d
SHA1 3483e1bf73ce547b567d2b21c60f29d88ccc4287
SHA256 4958b8c691969e68b6e0661e131dbbaa0d6c4e8a8c957d2839c6dc235f45a2e3
SHA512 d238a43729a25d838d3a0f544408a5b0991e7aed8f7c9eae911f76b9b1ba5c08343ed49cec11fc83ab0401e7aba6bd906e9715832dcd365425386e8b980b39d6

C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.RYK

MD5 e816108ede88a36d327c04b85358ee68
SHA1 feb8e661d1f31fe6e2c1b9c1bd71f47412927e8e
SHA256 ea4c50b7a30fd9d20881a6c203867daa620f1dc75ae73e1cf7fba521fb30106d
SHA512 aeeaf6891d70d2aa658a419fc45a4c5a935fef40618379fd528d2216637a7b0acc6a2253dfb7fad4fb6d1b607d3d377840cd2b55cc3f42fa5597bb92f4c69354

C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.RYK

MD5 dbf636934bb5a2809e89717d5382f19a
SHA1 3b49ad53db39abdb7e837776551aecb501c69f7e
SHA256 c7179badcea276fb288bd069651c3a9b3e0f123bf6dd6d3e8373cd773d4858b4
SHA512 2ffb8612e2012a85c3b3dd686fd84c8adab89de30b6c5ff4024ee30625e4843edc4bd06284bd0fb74510a7785b83376b4ef2854b67e45d413128e54eb279e8a8

C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.RYK

MD5 8a478cca9728bd2e5d027fdccf863880
SHA1 df782548d40db56922dbbea1f01e0628a2f85328
SHA256 736424885abed8a4a2d223feceb70aff410c8300f821d0a5d690e326c282da9e
SHA512 9833699c97a53110a599851b3c621684aeedc35c74e1df68397805338ddb71e5eab7c81020e2cc6be4cdbe1fe29fac45b1d58f611a7002fde6730c3489549482

C:\Users\Public\Music\Sample Music\Sleep Away.mp3.RYK

MD5 d0f0e7c4345ec21d3180c1207fdce3ce
SHA1 15b6ef870df66179bd2f457b7d9b8068d250fe0f
SHA256 4a64ddf9435b99641ad0fa55f6c9421f518fbb6ff87794c68342424a157f9635
SHA512 3ed8fc49f60c08c693552c07f97bea7b0f55359776d67213738446a329459262da322147aaa80a53209ab08b6ae74e136bbca21b060481c6a546ad6e3349ef1a

C:\Users\Public\Music\Sample Music\Kalimba.mp3.RYK

MD5 e463781de260ef23514b860299948270
SHA1 caa18f24c109f55cad9a46b05dda04f1db381c42
SHA256 774fcf896d0d76d9513a5a2d6b1f0212116e79cf5b722438720aad60048859d1
SHA512 d5f1b4645632d1ef79e08f28dcf65d6ea171bf85d3f9bf1e511a7764e31ff917e8040554e771e66f955f0a388aee47526df536eb8c6b72603722ec1f80e58142

memory/1772-12344-0x0000000035000000-0x0000000035162000-memory.dmp

C:\ProgramData\Microsoft\OFFICE\DocumentRepository.ico.RYK

MD5 8d7f5e289c08c7831b00a734ca61aae2
SHA1 0d3f5b0fe5348b906f65aae2627a51cc5a85e37c
SHA256 ce761cc4f6e21f0fa718efe1c6c571dab5cd8c9c0394dc4479e4c4e43ad3bdcd
SHA512 01fbf29b7894fc550c87b78b9d5968bd4303940ef4d097f3de0a530511d2ab1e37fbd3f6c9490cad433a6aa1a4f422ecf3bf8a2de35824dc94c17917a041d3de

C:\ProgramData\Microsoft\OFFICE\SharePointTeamSite.ico.RYK

MD5 cfc0da6932be2fb9f815ee782e1b84c6
SHA1 35c6223c3845f3fe8d3700ef7015253eea09bceb
SHA256 ef29d4b3ac9fba2ff8429c40136afe0c62dc5967f6180cde912d47ceec82bf78
SHA512 14e8b38ea82a6ddf7f22c443d855842ba2801584212d2792f50497b11d67cdd3b10e2548be42c9778a4c4ae1aa28c5393494ad07b14037477eaf4365f8a4627f

C:\ProgramData\Microsoft\OFFICE\SharePointPortalSite.ico.RYK

MD5 efc1cc4c5d3457c8f73c48dbc71c1c3a
SHA1 ad9f58169a1160640d89842de2d44d5e360c2d0a
SHA256 eb2c6b1af46e6088990f43908eb1b1f43e516b584ecd383e97a3f8c3505ead53
SHA512 f22d0bc9ad78f6937b492c6807bc9bc21370db1a697a8e52b3a0684356231d3a65f3d8d6b70bdc453750031a0ad015685cd39555d63dd36c39f0f358a3dfda90

C:\ProgramData\Microsoft\User Account Pictures\user.bmp.RYK

MD5 3bb60dc11293991ed607b62a38e76de1
SHA1 6b17cbfa829c6924a04f1cf3a6e660bbab997e9f
SHA256 a59c8641db21a989b2f9b5ec6a99860d237157bc6e9be32483c6e9017b159e78
SHA512 a339ba88155fcdb9c331c44942c43b68ec2763ef62c12f5268cf677edcc2a0e6c6541ffbda0f11ad413a233095b0124db553634829a441c0fd243ba3f0a0e6c1

C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.RYK

MD5 feb2830520ce821ff5c4a6dfec85ddc5
SHA1 195a96b3431c74eea0099f5c80209c7ec92eef3e
SHA256 db8aff4ad5bdef6e8079649d1c3b70a222897beb1bb726a024eec700f7af051a
SHA512 76d756b581aeb6976ffd1453a2b161439611237e71eebfa331b486ad052aab902aa5ec62364c50c35d85effacc1cb9c562973aa17064da3c2cac72875a48514c

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_ffe5b0bd-0b4d-4a45-aae0-555135d74bba

MD5 93a5aadeec082ffc1bca5aa27af70f52
SHA1 47a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256 a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SHA512 df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

C:\ProgramData\Microsoft Help\MS.EXCEL.DEV.14.1033.hxn.RYK

MD5 8d40b4e73ecbdceecbaf1b00b94d79b0
SHA1 b7795d56c08c88d827a947d9a3ca5f588c3fb6c5
SHA256 49cbfd4781c476205dd3cd10bf6cbf2fee29c1744bf68d291c7b1ef15e48d422
SHA512 9ea044214518d00a3fb451947e91f9e82fafff972fa974301da296854e4836c645103c69310d887b01de8006a7025a01674e5317400c375cc79df32c65727e86

C:\ProgramData\Microsoft Help\Hx_1033_MValidator.HxD.RYK

MD5 d1799f5855172954cfd1786ef8444b51
SHA1 7b8a176641f7df632aa9340887e67ac4302e066f
SHA256 5322f693096244ce367b4cd98b56bedd1fdaa1f0e11f5929b49269c0814ebbe4
SHA512 7a9d9cfe82c1555740acd0d177da6d9d2b369145a73341b34f15d500ddedb473b3e3bfd3e7e31252f5502a06240d1e40fb9bd184bedf1426556f2c19e6ea0e6a

C:\ProgramData\Microsoft Help\Hx_1033_MKWD_NamedURL.HxW.RYK

MD5 fca99f8be934f6537f14a4bb4e4a1a78
SHA1 1f3446d8c842a56f0dfe0d0dac9b345429aac698
SHA256 07ce5fc74fa6bcc8c4678e5ba2b35da8584501bf743b6ffe94c33fce5f440202
SHA512 24d7f28f1f79b61f5c01ea409ea3333b01171a9b493c90b925bcc972e718ffd16ae1e87cdf3a60538921edc46a58a48445847e729436c1241604196e2065f675

C:\ProgramData\Microsoft Help\MS.WINWORD.14.1033.hxn.RYK

MD5 b9ac96eaa1f1f666679a4badbbd1c66d
SHA1 122f1b767c0999c4b25bb0dcf19947669b099808
SHA256 47be36d5d27c3e301f1b9ccf004ce006fa46f3a9baa97ce758cf52de1566724d
SHA512 1110174b6904474f4ae94cc5e9e0b0890d317f2ccd80ff5ab9af20504298894334805a467fbb9a86e4cdb4361fd6060ea6292b0b2d2a45231b7906a9c83ef519

C:\ProgramData\Microsoft Help\MS.POWERPNT.DEV.14.1033.hxn.RYK

MD5 b46cbb7edf653988c12e86ee082f9bec
SHA1 9a90f1c472c633d099c20d3115f1cb8cbff080cb
SHA256 d3fcacfd394bce87307bd62696b5646b8a2f0a6f67e1bc23fb42e280e5a7da00
SHA512 b07bb98d0c07070b5b4b7c115d223e581110d38701079070383f384a13a47cfd51340ae45cb7e668241cd014fad1cfab5e0df9b5c8c598aa6067f5b768da576d

C:\ProgramData\Microsoft Help\MS.OUTLOOK.DEV.14.1033.hxn.RYK

MD5 93e9cf4325c96a8dc7ec980bb6547bda
SHA1 825ae18fd04ba7dfd8f99c59b1c876fe4ee108dd
SHA256 af5c385bed0968074685b0e98ae4455878d1a69289d43beef277e6295552b665
SHA512 bb5b3d2c3e972106fd35d81e65aaf2ace44128291cab70b9612bd9afdd11237b5b89ee6a0854fde142b601aa3d9e0b1195e9020e3cfa2f01c7286887bd89d4c2

C:\ProgramData\Microsoft Help\MS.ONENOTE.14.1033.hxn.RYK

MD5 31a023fab4af68309781934c8d10e421
SHA1 7f46cb959fef71f11c74e7f0bbcc59337a58b963
SHA256 b497f2fbccc1bdf7daa7de0175a18b1e719cced4f4ae1f74cf3bcd5a88e468b6
SHA512 cc8076615cebe704e393a197943c63a80089defdde2d80100149670fd8f48efc2988f35c890422886280365ec5b55ff9d78967518a8f259585afde3f524b31fb

C:\ProgramData\Microsoft Help\MS.MSACCESS.DEV.14.1033.hxn.RYK

MD5 50e71ee5808ef6ad29d66f91d5cf0182
SHA1 1f3f593a63c2a7414e62ee76de7070cb563f03e1
SHA256 bc5081bca2a83967dfe6a7f3bffe3b4dc53e90d412b6fc1a93383ac8b976ba1f
SHA512 6728216b235e6a0cfc8c506249e01ff5d72e5aed93d3535801d3a8ee5a292693049af0a27efb8aaa4753fc5fef9aac0d29024162196a8b68e004212415b3322e

C:\ProgramData\Microsoft Help\MS.INFOPATHEDITOR.14.1033.hxn.RYK

MD5 73db87ca2a9d65e658ac4e7908de5f8c
SHA1 6eb995d58d722afffe4284e8931c618fe69ca1d8
SHA256 8a2ac9d8d2760784ea968868a882e9624f1144ca0be882fc2cada5e4181bd02e
SHA512 82da70c0072a7d3edd78e3d107e9233cc4cdd16f273ce6ed4ac2dffd67d81bbf14785bb5f23139449d0e02b1f901130ebe64e257c306b82d9b192f707e0adcf9

C:\ProgramData\Microsoft Help\MS.INFOPATH.14.1033.hxn.RYK

MD5 7bf7f698737beb627f803d4cea5d729f
SHA1 d87f1b852ad78f27488b7594a9095aaf904644ec
SHA256 720476ad7d3f9a0897d9e0c696320d0f5f7136c6685e91761db994f570db3c91
SHA512 d7c54090fc39c4385bbdba715ea7d2fcc01a2a31461e98e6dad4e52967c361c0d3ea55c79f49f62865297e6c67fa2d39095b637d3c659452bf1f3ea78ae6707a

C:\ProgramData\Microsoft Help\MS.MSACCESS.14.1033.hxn.RYK

MD5 de89088fbba05867039cc478400ca037
SHA1 c407979115422e336bbf98fe51f397957c9f56ec
SHA256 42a4c371437febb9fb8daf8d3f89bfbcfcfef953bb63b7f316f7532a800a882b
SHA512 a3056aff1ea0c270c0a16f16f2e248487ef0db8ae450ca307bc6059874a2aed0bd9942114d62d2c6a2b51badcb70759dd4b4a03a3e546fbcfb11d5bbdb371ca0

C:\ProgramData\Microsoft Help\MS.MSPUB.DEV.14.1033.hxn.RYK

MD5 72fee2f83bcbc196b35d8b0e3193b500
SHA1 cb53e36b9200452ec0af6f85d2054088ed3bdccc
SHA256 ff225981348cfadd852fa08f2c19aecd4bf95240926a5b9901e4976474ebac67
SHA512 276dc653ecb87194a2edda768e8e7cf617ea952e345a1c0720b3ca3229e6dcb67e1e9a22a83e239d04f9e406ad020a000f0d758e7cdeef4aedbe34869f164b54

C:\ProgramData\Microsoft Help\MS.SETLANG.14.1033.hxn.RYK

MD5 8132da21bfdafd82336f779b0e94177a
SHA1 9eeef073c0fb2be58b887721090aafeebe5108d9
SHA256 b75ae66109973e055cea8937caffe51a175edbbdd701275d206cafd96eff9636
SHA512 d5bfa17ffebcadc5e8900c238a9f965cc9e3d682fafcbc9c136c74046e851f7b1f8d69814d9a6293044cb2954d817aab7476a621b0e752fe1778ca8d5edc262b

C:\ProgramData\Microsoft Help\MS.WINWORD.DEV.14.1033.hxn.RYK

MD5 af4b1a14748b668b119456e604828e35
SHA1 2ad5d26b8502f4ce17367a798c13168a0b0f4ecd
SHA256 d7186c425c3db8ffcf94c47909c77f6e77c44a24ded59ca5006d9fd71f27e5b0
SHA512 ef148c65d276f646b499008c181daf16234d6e2ad7f4f3f857192124933ce5d8010c02605134cbd9469adf9f23eb2eb8d95268589ff261cd57369aaa03ef83d1

C:\ProgramData\Microsoft Help\MS.OUTLOOK.14.1033.hxn.RYK

MD5 29537e463acd68e6b1193c2bc36a5003
SHA1 908c1737d5c7ad10e38f1365e385cbcab43adb71
SHA256 77b3256592626b4e9c310c163ac24eff7eb10b7cea9a7fa31cd10f8837f7e85b
SHA512 36b9d937dd8118801b13ae08de3ac622dc6268856b6c5977f50443e548c68e66b3d1c6ffd426df7330cffff6e3e31a807331c315da3cfe0288d0048ced2352cb

C:\ProgramData\Microsoft Help\MS.POWERPNT.14.1033.hxn.RYK

MD5 c1408c91d1e8c6e8c161d7170bbbd628
SHA1 217476b3ea7557106f64946beff3c87f923ad377
SHA256 c01dc28427e68ddc099a584f4d52425e59c60e596d01343748ab850943a43058
SHA512 473e12c7f8bff5ee073093d0d22673c50ea5daa18a8137e65ab2209e85662a7e64ba39cd2c1af7c10a5337b3f62022ad5ff0de93ab57cc00528d8be097b649d3

C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.RYK

MD5 e7a66a2f7e142f084eafa2f0cf24800a
SHA1 4020f04455ec9cc80f38a00073c89376d62bc014
SHA256 0f1b6fe302e70e2423ae743c11fb947d8856c4755326d0bf79ce88fc7d681db8
SHA512 72efc6a6bdc3f99cae131966d9ff00791f7fb7657ccaec2e5daa946dd5f52b4b0e0699661821b4405e33d82ea14a46ad973911b0c97a3b6a951199da500843dc

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MValidator.H1D.RYK

MD5 fd589f3b764a105f65948037b9e0ab92
SHA1 312d4345177d21dc45f76be3c03b6b529b1b989b
SHA256 81f79b0ced1a53379436e397a270a4486fdf014cc1892a187bc3bd7407cba7dc
SHA512 95899f9cdb1662e362bc7647f50947db815eb87be4001a39f88b634182e26331eeccce9619e9c77ce6a8060019655a6c442c0e71a912d5a50468a67ce11a2c29

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MTOC_help.H1H.RYK

MD5 1257c02b3f58dbd3563e343e38da2610
SHA1 0ddcb2b2592de2c243e26fd314f9756a06c3deb2
SHA256 512245b79440d99fa25308271a727f59b9cd3f63f638b2526aacc0fd2b7b71d6
SHA512 359a1a4b8cb36ea8eb101640531fc6d956a847cf9c2fe7cd92bc1bd0f3aa8b5469bf618f9b6bf789c29a74a3386f8edd68a23cdd1362e935bb48041a4f28eded

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MKWD_AssetId.H1W.RYK

MD5 ae5861964bc57f71afe94f1edfcc0168
SHA1 f687e490aec81e6732dce4646f7fc0773cb06051
SHA256 d0dc26c8fa30838c0e46f9e771634ca7c5c716ba41a65597f50802be92e5186a
SHA512 0d180da268b30fd630646ccc8360cb2571493e4a8a8d3aeca425429dc2b10b60e8d321e0abecd56738002c7f06c6c36c64dbcd5737850008a964dc61094ac5c5

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MKWD_BestBet.H1W.RYK

MD5 9f3fae5922441a8f601f3c6621066120
SHA1 3819512e67cc47fffb0b265e780174e1b3948921
SHA256 c76c748f6c91bf55515e3cfa6cdc73856ee62b69f38fb091307a332fa3d255b6
SHA512 e6df2025637d799810e132da12555b3994050ccd71eb892e75de466cd69a8c6b6834b309d39937f44a68fc119784c770cdf90a334d3ef0ad5695a4fe0dfcdfa7

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_CValidator.H1D.RYK

MD5 249085c4d6163c12392be75094543b0c
SHA1 19991414850815152a7d8cf779883814a873516c
SHA256 759d2662422cdc3491dcb795fcca5e1e98c68a2f51cde11c9ff8d76b94254a57
SHA512 bfa2bd1c1a0c90bdb0218e3a93ee98540e7cb04f4f78de26ce2ee81d0e6670e0fab2b950951200ff788bf1ddd999232715133f42354ac7a8c17781c9699cb8bd

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MTOC_help.H1H.RYK

MD5 49a49b62332cb2a9e8ae8a578fad9129
SHA1 103e5c04bde21b7e7ac0f930a124c5cabf5c8da7
SHA256 d8708ea4cf91ab34ac37a8e6122fc85ef938e0a1c34dc42c6646bc9b90b86567
SHA512 c50f504745b94a2f7c2a8dc6896065aa8d59047f3d7c6418bd77fa7747d225bd054692b497a681aec1d56b1ec8fd48ac48c205b73e508fe9840dde66ac2b8953

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MKWD_AssetId.H1W.RYK

MD5 7f30dc7a3fce0f00e5c361fe28c036fc
SHA1 b9d2966c39c6ff1219b6e0fb1529b2a484c68e46
SHA256 e734c004581ccb744c74fd3e4635fd29be62769ee2771347b25fe09212a79393
SHA512 f5e4ffc4d4f75719e3b6c4a96014b9916619c36f9f5fefa58f90ef876e3530192182f46ec2584cd3c27e0c9539f8e1f9b11a37d9b216c01d8f696a57998a7ac7

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MValidator.H1D.RYK

MD5 221cdd0d7924db6f0867778a75d2420c
SHA1 2cfad1f71e885e42e8cf4307b932cf30fef13085
SHA256 a928fc3c3c5de4d026f7d3dfe314de678258c1c3435e616a160e76f437c993d5
SHA512 59b98092f08832b38ff9263c54d5ae4583e0c6fa826911e18f4665246e1784cb268726c4eea86258df299f572de9b912502bdcc6b89999bc9654407eab0c3454

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_BestBet.H1W.RYK

MD5 621b3ffa073e7baa98aa5a45d639e605
SHA1 ade0bddf2b74e99c33773b46108be86cef7e0cc4
SHA256 2ad4cc0ab032b30805779c58e1ec2eb1dadab4dfe16b44a3cb977d153bccb943
SHA512 6ab105d896886ee586b0543bfddc3b9d1f89bbd3207cb14cc61b1fd98bae34756f738a705cbce8206fa6758977e8a44f0a0e8b04fca8310cfe52ffceb80d7f5b

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_CValidator.H1D.RYK

MD5 5f33f35a9597232837b482e6339bd63c
SHA1 e11d6975dae0d6afa359f552fe885d4a5d6507a1
SHA256 8a2ae1277c495c1a1a5e480b6fe57e35708c92c5f070f591164817ca213f14a9
SHA512 6c8df3d669f42c6da04be5230a97843d42e83f556462cf7d0295d9e5bfb72f97c4519f570b7ea83c2e6bb93748d0f1639e1e3063c9c74bad24d22d32b57b3d47

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MTOC_help.H1H.RYK

MD5 7dd7f61b642a0a57f0900f35b8e4d39e
SHA1 ce091e868861127317c55f0bbbe3228beba7eaa1
SHA256 c126cd45a5c4da7e73f41f2758d42cff2b67b696c1d782650f98090092c07240
SHA512 4d7862d0f0047a75a514a4c1a1c5171b53a07665be1af5b79cf5853c1ae1ba4446cfa168237c7db44f84cdc5f85dec7ae46cbed7ffa104b1be66731b492ac03d

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MKWD_AssetId.H1W.RYK

MD5 6a228782b8b1ccb8e08e349070cd9070
SHA1 f5e50e738654460fcf5009ab2ba04756d1d1856b
SHA256 64d05b6269849160e2077f94535dddd4632124575ab2c2e238baf9172b67c98b
SHA512 ba471fca75a7dd3316ae4035be2d664227fbbce44050c71e977ecf230c92e7caa69e28971a4c323ae2adb9e54e144ce2022c7bb262ea9bf9394690a6c7d33ab2

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help{68DC71DC-2327-4040-8F03-50D6A9805049}.H1Q.RYK

MD5 74818dc1bb2abdce48ac46189658daef
SHA1 664523d30e949dfb2facd9a1c9d19e114b91aa4e
SHA256 27ec9007e1ad0303d75dc1e27e9dfb93715500e23466e1cfdbe7365d71201d72
SHA512 c85c6503a656c5b6d27b0c023fa0ed8cb08ac471431310e4355c587b55d157ee419d8130ae0f0d218f211d03f8759b9ce5f07884e03a29bf4f0961dab9ca5beb

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MValidator.H1D.RYK

MD5 b1748e351e71616588b9005bcd898919
SHA1 9b376390d376ed5a6d68744c2193a9d8b55e0817
SHA256 38a26d1ca67b87969a4ca47f4e1e09480d13a248f0aa2b876e3702a8ddf3c9a9
SHA512 b17adb427a3e6990a5f68d654417ef96f390022477790ce1dbce8d130b661a10cbb8503c264e3854c66ca469d843dad6ad306d60018208b7ff780b63b85605d9

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help{45EACA36-DBE9-4E4A-A26D-5C201902346D}.H1Q.RYK

MD5 301bdf2d8198b803d5ac6a2e676004f6
SHA1 f813457b5bb32bc993430998233ff61403adb5d0
SHA256 2963de73fb2713ec3c9e9775c2d7c25a1de3cdd33650e1f4060bc2b8605bed2b
SHA512 2dd856824da7a967531e2bc6c19dd62ac25d4ee4c322dd04e785cc4226cb19c14b202479378764acb64990f2fa9b25f1e33c83842407425d64d9f89260b1aab8

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MKWD_BestBet.H1W.RYK

MD5 0d13bfd01f4cc29bc6e58e396ecc1571
SHA1 04be6b5b4c6755402c9f954ef8df21f8691728c0
SHA256 d1b49b153c75398702de0e9061f3148df9152a363d9a351446505a4f20ba3926
SHA512 9d2a4ba494ca3788b1247b879920240aa07eff960970048958df50d53fcdcd6aa6b524a66e204c39b5a65a939237eb1ba2953d3829f3e177ab076a85e2ca9132

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_CValidator.H1D.RYK

MD5 01f9c290b4fd7e7d443db812fe900b71
SHA1 d4e4c45b2a94350743d66c66f1f52bb19545bfc3
SHA256 eaad3fbbfb07bb1d46073ca8f74fb33f841cef0aeec355ae72399c9ca713d2cd
SHA512 68773061b532ecaeb9406be5ca2af3fe1e4535f0be30fd109c26b1b7ee200c2257992e1daed2e4d07231578ed207caf444d3e8fdea85692de04f1db44f75d13c

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MTOC_help.H1H.RYK

MD5 bfa5de6af003e4d4e4e6c82d0abe75fd
SHA1 3bd5c0e9b7a2ad25cfc4821c13e213aa2534cc4f
SHA256 823a6953d556df63c43b47e0559e38ccb15ab3690b2e76c06621cb8a0fd443db
SHA512 ed8e86af4055c0109190e8c416328859fdd0e42bca003e2964ada08b82ec4ea40d988599a3af46dffbcc255408fa6c80748ebf2c3d87d4ff34c82dfb9554f33e

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MKWD_AssetId.H1W.RYK

MD5 c365e702a96cc4ffc3168721349e8480
SHA1 86844b8c4b6920128cafa62e6e099fc7a4db61e1
SHA256 c2d2cd2ccd048aeddc8f2cbb462bc4c542440bd6489b6ba4c94bfb22b9bec308
SHA512 8b25fe2d7c1a17cba4f5115ab141d45fc580b6e2abcecb77579954466d891de2473f195d997880de670bed65cdda4c465db177c94f7655b65896c6dc5d855897

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.H1D.RYK

MD5 03d716165323170432774ae25fd9474d
SHA1 6261321e079c64e8ff91cb4089093ce985b9b975
SHA256 25fdb71838e69ea15e58dd8fde21a7ea9da287068b3ef428f4d8c24fab1c226c
SHA512 365cba386cffce93b0b8158730f8cd2ae083df990af0daa1aea907be12ebdbad5d4ca9a3384c03286a74dd3242e98a9d6c22e2c32c811fb97c4ed624a8ad1e4e

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MKWD_BestBet.H1W.RYK

MD5 76faf8c75b1d6573a2fd465cda0f3ebc
SHA1 8fdc4fc1f5cf123390aa27467486c52f865220e7
SHA256 088da265e105589243e1429f7801c2ab107976042daf760bafbdd5d521553938
SHA512 53fefc2297ebc86432393e5c91b16c0dfb63cceff0c27942fa1552255689a56ca267e1a265043f33500e1163775a4fec2c21f49bec8e7346068becf868522acb

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_CValidator.H1D.RYK

MD5 00c7ce93f1f7c130eb8e1270f5ed67ef
SHA1 2cc9686c7a6d2c7206626765327fee045ee6f3f6
SHA256 dbf65b52d1edc0a9ef4d9ef19df8414ef35cc25e4e45c9775622a34426f2f491
SHA512 51251216472afe7d2a949d6d62542742251915cfdb7dc852bfa9bae4bcd0a37f9eca00cc7240f30b3c27a73294151d1838091fa20066c9acb79d53b58b856efc

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MTOC_help.H1H.RYK

MD5 837cf24f569fdc677e47a564819649f2
SHA1 4b8e8d88021ca7e6a3de41adf1f4615f2334d482
SHA256 f5cdbabdfc84176c20efa21103b00749f71e01c03ffc0bb4e8ab470aed6db46c
SHA512 56e02879e8183a7d87f4aaf5cad6cf2a518be34b0784cce0769b2012cc2c541c57f0d2d2780a09dedd97827689b792e7e6723f8b9722ca2fad0071c88df06e8e

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_AssetId.H1W.RYK

MD5 e0639476018c394a17c1505637a67ac3
SHA1 69a5103895074bfcda404f82e857c46300e60774
SHA256 f9b1e1ca8009ac4a3933ee5c96ce46f31eaa1adb7d930c18b24b184bf0c4af00
SHA512 72bc97006fff6d56dc044d6c1fc9046ff297f0776330d58cd11533d75367f3b87ba34816d783cb82badf8c5f192bdd6f5899874f314be22e10c4e7f4d3ede8d0

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MValidator.H1D.RYK

MD5 8e58b6c21a82cc7f8d21bdf236a8b2d2
SHA1 15524b794a7f47d32ce8998a06413b2aa525d029
SHA256 678eed1461617c93ad24a2f8e8a6ec2a268ab8f1ec7be4eb3f2fe0fc275c1bad
SHA512 933957cec8ead3ddf7b95865a9350f4db2d192cb127d822b981628524a223ccf6ce61494d8cf46eed0d1847cb5e62cf34cf0fe6adbc1dc30509f21ab9d067235

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MKWD_BestBet.H1W.RYK

MD5 3264129884cb3e3de2d8b176db9f927a
SHA1 a38db5ffde57385a9a7cbb448240b96173b0715f
SHA256 02ea1cc2256d64c4a3d7e6a5842ae8852a17d2294cee08caf90467c343679495
SHA512 20be614d0dfc23c05f01c19f92f668ce6e4d316c7b14b170860b69d56fffe3c1220abaa1dd47b257e6d970afd270a5ba50ec71ee49b7ce0588fc795df639dd0e

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_CValidator.H1D.RYK

MD5 bcb613fd09503050c37c8cbf315420ba
SHA1 3647a01406c6cae5f5d8e54a7be9eaa59b737b06
SHA256 49e9dd5f3c46df74dc00cf53a90777703c7eed13fc2ba2f07186a03b337fc7e8
SHA512 fd4ed99d86d81c5e9fa04e8afe92e46fbd504db987c66bd64265499d7320ebd4ac0ef089c4cae67c42899e7aa5c1c11cd9d188ee4264cacff4b0f7e7e109d701

C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3.RYK

MD5 4280208a52ec524ea11f6d0d4e130548
SHA1 fca17a8755466bb51dde51968025c9e2b40208e5
SHA256 9772e3bf4be99d7af6e70818645518c0529cc5cf65a3597e0bf8a76596b7febd
SHA512 1b36cb59e13e5453fa9db4c3cd82d8627b0c902fd519ccfdc5a8d75881d7420d22c700bb5efb2b2426dc434dc33b6c9f284135a664d59a3a57ea0da23101ff5f

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MKWD_AssetId.H1W.RYK

MD5 c74a4c478dca227f524a1c75318a60e2
SHA1 ce4387cda71144552836af63a9631c412c688ca5
SHA256 89dd949b046a74b6820a69f6e82bd12264524bd93f409caea89b751a68837691
SHA512 f90c4a61dad38cca9f064bb1b7f22d603ea5203b10c3eb118388224b4cc196d3e888c2cdb8bbb619942233bc294303ab73e7ce490314ea4a3d739108c1ffc319

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_CValidator.H1D.RYK

MD5 d7199f8c1562cc72bd22ec317b2c6529
SHA1 ee506c1f8471d3dbe50436dbf26b0c5e117db980
SHA256 63797989bde5b7207ab86372da672b4922bd32f0f40042b254b3be1ef52f876d
SHA512 dee3354d8ab2e2575a890de04309937f615ce9862203ba825cee2d23266a7aa073801796bd2450762d4c9c82582057af0571ddf856b674cdab64767a6afed0a7

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MKWD_BestBet.H1W.RYK

MD5 8e8c028455e26c59953f94684af2ef16
SHA1 800c298788e29f4bd61a2e7f24d365014c3bae24
SHA256 89b7af04812c3384a3e432bf0c6cbcc8d9900ac82c653927221246b8ad70360e
SHA512 8b5dc711351d8b83b2e4aa15d287545e5e18727549867c49a546b2b87daa91407fbb830efc8dd46f54ef29c8568649841b72fe3c1c94733a32d909e6f4bd9ce1

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MValidator.H1D.RYK

MD5 9e981ee1a8426694e8aab64ee00823d0
SHA1 8e675034c03c4d013aa361e75d7cc847b26fd521
SHA256 212d447a9c87f47b60301e22e0ca5ec0ef56ae88703771c50a9101fbd6699b03
SHA512 caf5a4ddcc4c617cfa4e90fb3c3b03c9cfe54c6970432aca13e1870b8199fc2a4ec9e371d6b3df2420f50a00e43f3694c49812c38dda08260f3f39457295e11b

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MTOC_help.H1H.RYK

MD5 31842d1a0d5e13849fe39525bf2abb80
SHA1 b43b4745f15acb30d0ec34074937123abaa6f2bf
SHA256 0a2e426ce6acd6c4854323c96cde296c933bc853eacaf37ffaab97f666115b1b
SHA512 51aa6934d955b6edccdff192c052f43e872967c9f039b1e3ea5e743a9c2dc9971e81778c8e0eb20f13729ce3b04c1b8642890f5672649c8895e7d123d57c111d

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q.RYK

MD5 1272e834e5d17615432bd43e46a0c8f0
SHA1 cc1f15af1b56c94fd6f2e3b1bbe843bef742b5a4
SHA256 85a9cc07a0a96a120dfdbcfbd2540060980996215d73bd146dcf1a6fe4ff09ac
SHA512 3436a10d3d4b8013a4330aaf1f65e7e9bb689a04bdfc60c470f7ba691370e8d84e1ea8b6157a88aba7980b6dcbe563e00076a435292b0542ce96d7ac25ee9b9b

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help{92F2118A-E813-4A4D-9DE2-F96A9DC02C53}.H1Q.RYK

MD5 f554f50ecb0b88ba9d150aa55438c6d7
SHA1 9531280358e1920373383c47741e93ee4f35be38
SHA256 8e06092bb337bcd3e1af459cf0c27fcaf94b0c8d5086b62411509e1662a06bd6
SHA512 608013f9731cfecd233495b58cb1d223e27d945924b645200385aede0f120fc7c1acb935edce4a05be42a36dfc8f43223a0d9350621a1860b4254b498ee5ec61

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help{7E352021-69D6-4553-86AC-430B0D8FF913}.H1Q.RYK

MD5 9a6f6729a4b2ebaac8b764ea67e223af
SHA1 708c3828266bde37b02fd813ab66c9dcdc3d9790
SHA256 da5cdc2cdc71e40e6eb72b906f5b90232b859e9baa7b78d6230423949dfebbf2
SHA512 9eb04f875709cc6dd1a2f2d5afbdf1794e278b3e91cd423b3d7d1f3dbb0656a4693ba50b87919f296d6bf68e035bf179fc88de7d1515f4103472d9603a323cfc

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help{E1E8F15E-8BEC-45DF-83BF-50FF84D0CAB5}.H1Q.RYK

MD5 23b0dfaad88795f09bb9cd2be5add95a
SHA1 4662d8b87147919df00c8be5e4edf44fe2f9c73f
SHA256 46206c4349ceadb306f0d35f53e330036e7f423277f4d21bf011fa42a996e28a
SHA512 2d66d936372f603cebeeed6c94eb6b8c2d1745a261a7629861b28606f416a4b8d06296f7ca14f4219c2fcff33dbcf7bf23224d4d1648d80c292d75c84ad59107

memory/1900-12945-0x0000000035000000-0x0000000035162000-memory.dmp

memory/1148-12946-0x0000000035000000-0x0000000035162000-memory.dmp

C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\cache.dat.RYK

MD5 fe243343c628d8a8e24cddeb84b93b12
SHA1 ea6c2c9c59eddf70957a0c4aa51c8de7fd9fba9e
SHA256 0923f6e570bf3afb2acbd02113c6933c5a3d17eabd3c43a4ca184a452542e518
SHA512 c348e5afd4480ff27e1e4e80b22f705615dbd2705063d291479a46bc52b9a027df799256ca7d21e13dd75b48863cfcf341834a32e9de74f22cad525ec0ccac6a

C:\ProgramData\Microsoft\Windows Defender\Support\MPLog-07132009-221054.log.RYK

MD5 2738e83a31561ae57a6ce5c58a7814b3
SHA1 644163233febaf517007b85702f79cdd85537f18
SHA256 ad5e5af5e3f04991477a820f340cfd9e93b59ff21006d9721144c87e17382afe
SHA512 8717e0bea1d21c7f4c517eb19a6054a1ba21f177d3ad7a14439541d746af873f48210edeaf6c5582ebf9e69b5a7fd8d06aed03ec9373ddd143add4aa1c1331ac

C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\state.rsm.RYK

MD5 2dfd9b6428db157c4168102a74188129
SHA1 81a9303d8f335fe791ccf7bb06b3adc1f1014495
SHA256 ca82bf5de3c3bf8a7af70f50197f611db697df4bb75b1f5cea75f9658270d88d
SHA512 9f500ae1c7bca29841c6526dbfa1570e17872368370aab074d7f1fdb1e624666003f78be89c79d062b8cab041ea629bc8d3e2fb13de27b7ffba70e50e1f59939

C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\state.rsm.RYK

MD5 05ba7e20fa5b65a2b41b506b04f08328
SHA1 e27f547c0a796f5e020a37d4d02ec27b2ed85090
SHA256 b834e29744aa37cc6482b719368c843ae58630724d526741301e1f7a6b2a9b65
SHA512 724ac84dfa94270aab5f7445370fa7bf151b2a2963faf291deb7f73f410484e92235fef6c44d2b9d4c66aec04211fc2f63437305ccdd0265aa3b2193ac084b90

C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\state.rsm.RYK

MD5 339285d3da0fe74fab4576bfa4de2537
SHA1 5280d506252cbf643b3ee79e2f934c64766470e3
SHA256 54f711eabddee004aea505df2137d81eb107c83e19155c6da1a4b9b24ebdc8bb
SHA512 4baa64f5bb4c08d9749024eaa3c6490cc8729c1d13e606b39b880f3ae9ed3d36dcfe30c50192c6c13c3d8c967eb5b1cabceb6b9cf6293c09023a2eb1762c6531

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm.RYK

MD5 6ff4556c29261b408c197326b0fe9469
SHA1 b92ae8d72bb7e952ba929673039f54125db5e2a6
SHA256 63b3f8bee473409641c2f984069c4966501cbe46f537c9834f2f3691853f0800
SHA512 ae429725e15b81d9cc3daa733cd10b98830864a5aa90548edd6cebaf0e15861d7ce65566a08dee0c6349a7c1121272fcd692fca0e5a03cccb6ab628ca116bdb1

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\state.rsm.RYK

MD5 8f4e29504a54aca8ddaea95decb56ec0
SHA1 c8311450cbba13ee62fe20e4f4b514a2eb839583
SHA256 4cdb0e8e0a09df8daffc956253a156947188a94bb8df62f4b93881d958b0f725
SHA512 8df535a15d91022c0b96acb45c9c8ee6a7aeebccdf6d6149216b2c0774cc8e7d324b769f64f1f702b1cb37cac575d39399101ec9ed8d6c71149aca716814a351

C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm.RYK

MD5 93e0459d380fd37bad76ed0632c69053
SHA1 dc3878d0421e312f4758e57b1fb449c38770c441
SHA256 2643cc3d6bda83511d0ca44465e91360acc9812ce2ea8a5e1e0ca1edea82f8d3
SHA512 d1c3dc830b2b31eb3c44be7bebe60fcd1e3debf7966a3ab1846ebc200b4a21d2c25128eeebcfb9ef961fa3cb1882be298eda1e97644df4f9bc6acae686c4ffef

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_ffe5b0bd-0b4d-4a45-aae0-555135d74bba.RYK

MD5 c55987c54404284d14bc7f6913ffc679
SHA1 e3cd9ad208223e180539226aa1b26dd556f1d9a3
SHA256 2a518f83d4e4da2a7a0ab74d09cc6a33d5e5dc1054c9e4f704196ab3b2b5ad19
SHA512 2df0d536ad1933517448449384e7c25e1d24d1564431f752d1880f4ff241a29a3a8ed91cb1de7107e7d34aa32c412eaa8723470f5edbdef885e458e121952902

C:\ProgramData\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\Windows6.1-KB2999226-x64.msu.RYK

MD5 1134d5c5b01b00256c2f2fb452132133
SHA1 e2aead6ed9ae57569b1753e428b68c81efd53315
SHA256 a4ec1afd89ed814ab75d26242294aac48d948d6e555c9554a31f7b3f7317c178
SHA512 450ec454c702d943b0d931581a84a4d328a8b33c7de7411c04c5d73837aaf52b128baa6716c15bb8999cc20a97150e731eaeddf3b7f3942342d013b132806a45

C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab.RYK

MD5 e165dd4eb4f4f99da943be9a10d176bd
SHA1 b76805cd3947f75d60d63de39ebae96ebc643273
SHA256 fa4d4f54f13c638a65668ea31612f3d26df1002ad35841e470a6a11ff66219c0
SHA512 16290eda7240a4b987e1f0d4f9617a984239f7c73f3e23cfce440d4ae6ee362a32701a8d953d19d719e2e4c697e50f692d5aef4b1d3d0b2297fa949d94172314

C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\cab1.cab.RYK

MD5 07df4cafd8bf48b3e273f1e347c12548
SHA1 2a4fd03aca528893beba0a751d87b7b8a083756c
SHA256 ad803d208249d2361d04193d7cff5f9da6f15e016c32aecc1c31dc49b0f375e2
SHA512 079bf7d3681ee5ff03d1d686cf215319532c31a14ce12a2b95d12fa4d68173d02a1b582a343aa8514a44bc99254764f70e10278d6b7a063f279caf31b0c9ed91

C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\cab1.cab.RYK

MD5 6cfab2f0853ecb9ae9893216ca4356c7
SHA1 941fb523f68d7b48d12bef1092a1f3b23a0b3ad5
SHA256 d7679d6f96add87e81ea373fa6a94473842b4884edc26891019ac6e10744bc09
SHA512 d1d1b187a77cfd57fd8016cc6593fc40de42485dbe909da377d50813e4518c3af8a6a1f500d49b6bcd2bc71169fb5bc34fcb4dfc482673239cff7734b3b14426

C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab.RYK

MD5 65baf47c28cc61b560679bbec4a478b5
SHA1 d7fd3b5d2ba389dbbd157bf6dbdcf43088610b93
SHA256 07475ba088a2bb8523bd75ade4b2a5678a2d51c06b2801812d6475d049448e51
SHA512 c2b0f2e065072b726562eac1124f58267d7f0e89e1adc87319bf9317b29be615a43658a8dd70d30ced91247f594fb684c7246981389a1915fc39cf1a0ac402d3

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_ffe5b0bd-0b4d-4a45-aae0-555135d74bba.RYK

MD5 c9baff257fb2943f0aeb75678a196f93
SHA1 f994ac15910233b4c88efc419077b29b4cec5038
SHA256 15bf0e15c52b8494f15eca1dee0b3a7b9851f7a1be76f04239d65b2bd179cdc9
SHA512 b172d186ec2111afd1b354610a610596b182a089c9efbad285a121b73af5d6a19e47215e4a3100342dace3a6bf47d11720bbcc83db85d0d155398207f30cad7b

C:\ProgramData\Package Cache\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}v12.0.40660\packages\vcRuntimeMinimum_x86\cab1.cab.RYK

MD5 612c106935dd26ec4a09c07c9bc5f08e
SHA1 8aff950372a2c957293c05bddb7f33fe4db36251
SHA256 b0b123480c2056dfc97266941bfc55c98625c2d19719a88e0f98a1f4d1790041
SHA512 6690d11a8a68dc7fc8ca24dd02ffca42083e99e592bab9d05a387061527d1aaf0b8881016cdd876e43f58c9961230ac3cfe072cfa5095fb15d61fd88012173d9

C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasdlta.vdm.RYK

MD5 6532b1b2e02cbfa028b4c6b6604e1be7
SHA1 aaaedb03f01eb62f02b5099952c9557e533a53ad
SHA256 47b3395ed7fc5deead9d063b5e4dee67440bb8cac6ff4f08f14bb0941ec44907
SHA512 9c2f10fad3a1b145a396984b310dcc71ee73e5714859ed92f3a6e09a0c2f97fbc31e7d82d1bfaf7ba7a986fee3386e36e1d384626afad91c913f41a553c9d7e0

C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasbase.vdm.RYK

MD5 a2149a240ed221d6d7deef77684f2cd6
SHA1 5a17deed9de4516b8e180f08444135c1fe40b001
SHA256 d1ab55c5fa78b92c4e7f9256b93cb430476961a898e643e0f57bbaa13a7a1e10
SHA512 981355e00c4963584593cbe2d67096430fc6e69cb63b6c454865df909e1c7851435ce4188bfab0f106078abfdc718d9fc61eac77747a78347a7c1b23fab999ce

C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi.RYK

MD5 7fe8294862efe8a0da6509f4341fe8e8
SHA1 13667a62d8051425ccf532f09235fb8a884a31fc
SHA256 9f5f52fe61a836a3ef0a701aefe2089d012ec9b0ba090be3eb3e154bbb619fe7
SHA512 fe2b5b508591b08b9c40efe2b8ef089a6cd83baed48c57ed26f804f4265221055927da431bdb1b05c2c7115f2f3c83a6116a8011fc0454299e3e66c15132f09e

C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi.RYK

MD5 6afa10c016230c459a0cda5ec3d9d67c
SHA1 120027ec0ea11b36c9ec49889500e8bf660bf186
SHA256 8c848f39065425bdf744ebe4ae210f8b35c45a0354cd90f1694cf13c530741ff
SHA512 aacb8b9f26438b535cdb736fe75572d123f3dd44e69e3bf0a92f113a8430cf3b81fa99ae74163995d49251220066776c7c4daf3d37e615029fdb56f17f8e3f23

C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi.RYK

MD5 5966fa4688d3c7fa8f21e021775b77d2
SHA1 aa65c28ab2deefb69690c065468087e2ac58f1e8
SHA256 411466003c72fbec7615516c237757a63ff1f6616535d6eac12c7e5d12862d1c
SHA512 5e311188c142441eae5c61088fc53d536a4485361a7cf7d557aa01c679981983c64f4fa738ced9b10f480bb146817ffb07cf89a0bd7ff35cd836e16de9fd783a

C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi.RYK

MD5 82907f7ed5267ae71e42f2c9d6671bca
SHA1 74261400e73570c4a18ad21b5fe1bbd7a0fdc6fb
SHA256 f5f6e5ea382363ac7a4b0596a13d8859ca29411c46a73106d18975391928aa68
SHA512 2ad93e60aabd85106c5f2b3b8f7ca99ac85b5d2cb4e175636b0ec8f124d05ab81095134e4bbec17a421465f267eb6396c6dd802d8d94f35b87083206f40082d1

C:\ProgramData\Package Cache\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}v12.0.40660\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi.RYK

MD5 e46d189e399d4e4c9e498f932e64a290
SHA1 c901733beef50a9dde03a3d4d0ebc3d69687e599
SHA256 b9e6068130081d5d976132f0df1417be9dd744524222a2b5fda78384ca3b9b66
SHA512 4bcde5ac29276d1f2a7a42cdfe18d2f5bc2601d3db025efb7d6b7dbfc95f9b221b17e90bd998a3834f5b59453b5dfaef86516867fb1aec19f82621a5710fc5d7

C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\cab1.cab.RYK

MD5 1ab3b474ed29d86465668c619f1d05c6
SHA1 d3f8a126ceeb9e6bb543ef0820cdd791dbdc9c10
SHA256 4e5cafbbce58e3f4a005044591aad6c76f8a96be791ac8acdbb3c68eba69dd05
SHA512 9cb2357dcce7d95bede950e744b8c21aba1244f35a2cf0a149136526b5c8628c83af806a07b0b62f30507360917d79ccce3fb5715c435e15f1da3cc2b1629ed2

C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\cab1.cab.RYK

MD5 f3504fb00f0e9300a9c1acfd95594ea5
SHA1 b9bbfba3d47df938f1da9fee9a3bf8bb5563f6a6
SHA256 0f489634d382b7294fb89f15172fe49ecd278bdad55a5937bab79057ca6d8d5f
SHA512 695559cd9c86a9652ecc5d705b9ac9abb1cd9308095abd84f64f749126b2181fa3d288ca16b00a3c8757bbd466b41423bd105c43372bb10b22567041f21fbea2

C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\cab1.cab.RYK

MD5 dbd25b888e92cbeccadc59bea4ef63c1
SHA1 aeaa62cea837522c35432f2695dfa06c9f425c3f
SHA256 9ed998ca7f4b809449f0b70013470a1e70cda44a8ab2fba091d5b920b776558a
SHA512 9c52e0b7665ffe6414cffa46d42337eb9ee9706e457b7a674ec747ebd63d583823a994b1c2205ec18611cc6bcc0a5dcda6192bbca9ae930b14ebc37e2461155c

C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\cab1.cab.RYK

MD5 146d5536a2f52a697398072d77427972
SHA1 46efcd77b787224c7a9568ead37bc04f6a73f8d5
SHA256 e61218b45f3711c2c63e241908a46542c2a52ad88ccbb75fc3b7520957ccb284
SHA512 ee41b1c25d7ce48efa391cc00c1511959ce18d6247fe8217caa9c95639edf98342b3c6a5f26a6d211f866ba93274260b31f3c64d6d3faaf4700526182e256d47

C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\cab1.cab.RYK

MD5 f7b5ff03cfda91f51ed800afdc1c6ad6
SHA1 a49f40e2bae86c95bccf0e53055a6cc82ce97e3a
SHA256 9bc37ee5b2f09e8f4d8ca035006e3557b3a3c534ea65ca0395b09fb094d3ea8c
SHA512 bc003b1c43d565269e9fd2c1135bdf1f89a1180e06ef70a58cda4f6eb76b62c4e0f581ffb487b6c2a9c57d38251223003fd3b695d9b0aefac61061ecbc5ad3b0

C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\cab1.cab.RYK

MD5 c0ee5314ac7fcfcbda5157bf0dd3a41f
SHA1 5abd0f3202f633e8828ecae50aca6e2ea1b6354d
SHA256 19019913fc12c8d1b6b35ff3321d894a80170aa69263e57beddc697230a66c45
SHA512 a9ae0e494598fc22a0971779029add47de67c497ede96d55b74f841469cca9f3d14260fae43790327bc0484135c2e9772ab07ddace555e203c23c107f754a10d

memory/1772-15496-0x0000000035000000-0x0000000035162000-memory.dmp

C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\cab1.cab.RYK

MD5 572e508b31bf99422554763304c11833
SHA1 a4ddb2fe4a4f9dbfba79dcca5fd8d928b08e3931
SHA256 4893f35f53c90a2bfc451063c596d211004753738ddf62b0172a91ffd45c5972
SHA512 462edac7c4e607d05f0821e5f0d7f0da949bae3295825a650e1c9cdada035d98a8945b3cc5ade320666a19cc1374d9bdbff1c01a19a0ff31e1c5b1e6d63429e6

C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi.RYK

MD5 1e19d5496a3be4b4a97e8ac9211622bc
SHA1 99379cabf6fbe0892460d2b4bd1783f17839dd45
SHA256 46120d3196dd404b919cd254aff7bcfd78c0cd93fda1cb9adfe94ff5670a325a
SHA512 b003cbe67b7d8bb8e5061587bea0dcbcaaf8290139b751ef1eec1fa84133f079be695ba5bec8035e89d308b513ec6d1b94dd75e589e0913038f3652cdcdfbed1

C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi.RYK

MD5 964d9e4f0ad8493270b734ec492356dc
SHA1 541df736755746e86c3e6182cea4ab0509aaddd6
SHA256 58c1b67a1395d5540b419d21b0aa82f139c4c1d232ed1c464c938a44aa3870ba
SHA512 3778da663c2f646235d153a5491e4c28db07072fc0dd0fa067829e4cee5246102a6ab01dbeb7dc63ff4cf9bdb4282946ff575bea76120a4463ad4bffa6cc526b

C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi.RYK

MD5 8d5e4ce98047ae2e51df7b57c9a0f970
SHA1 5b73fab1bf3cb490f24b9454b8e89f1cc7683bb5
SHA256 f458f9b7760b297e349e1be2808b6ad52c5c9c79175b8f01294fdea4bc05e6ef
SHA512 f65f1259e6a70e198815e4db6b1afa4ff35e5cf3fd69bfd6c3882562944eca6c923d9468f15f9f7149e44c6658da96a65d3fff59a0a07b6d85d8b904b02bc1e4

C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi.RYK

MD5 fcf80b1098d47bb8d2738ecb90fea9a4
SHA1 51bb2f31fbeb72f8d277d20c7b0da95eb0aa6e43
SHA256 534f578fa9dd237b7ca8e38fd566e2b4b9b868c17af0a82b803072cd97ac0519
SHA512 7bd65f605bbfff42065371cd1dd5edbfc59b7af9719c08a6e95a652dd8274efe0def48dadb8fee6e6169960583558b729b6ebfe0b66224a11168744ccba993cc

C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.RYK

MD5 e63be5ec740d2020079d763bf56fe20f
SHA1 a3cafdfd7cc774d08c4c8c65021154e62cb8caaa
SHA256 f493e349bd8e81f7431c29875202c7585174e9ba9bdee17e7b6e14a9d4aeba9a
SHA512 1ed308e321f2ce8d47917c63aa4ee365e62c388982b6814910bd39c74fda40002dd26aaa52ef06630e55aac57e714aa117f1186d4318bb7592ac1a88d78eec71

C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.RYK

MD5 d48c5784a295f00fdea269d6d6f20997
SHA1 423fc235c5f9666114981172d53b863e1a930635
SHA256 693e2093cfeb82c4948852ec996b102823cccc2648e5fbe4055907735dbd8ae2
SHA512 44041ef8a7092d793ad5e9d5300835289ac1127b9aaf485dfde37aae7c9ed04f2dc00b3758481a300723536433c6faa96c09fe216697a8b86b62af90af2d22da

C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.RYK

MD5 c3ba12dad8902ead4469f6e1c5afc2b2
SHA1 37abdfe1c5dded99ba96fd634a2a970e003e72de
SHA256 64588e5468c08753c2b0712ecf91212c31c13a4666898a09215010a77ffea514
SHA512 eb73ef82b0a3ee3f69f08289d7555753cf02999abe49879bad57a1353c117b82e605f8016ad5a10a418aa36fa7f7f2b8321a1c7f874bb13115d4b6135e8f681e

C:\Users\Admin\Desktop\RyukReadMe.html

MD5 74b63ae5ae7651c3e568c0008e8e8115
SHA1 f0cb2c445e2a04bbf972b0a12106501250929282
SHA256 9d02b65535798947514ce2d4191de4e3789036a05e8b4bdfe87bf5957de8afa3
SHA512 26cc7759eeee635cc700ab0b075912bc27b92defe286b1b631fde70f30c64b4433ff1af386e08c3ccce57de404e47219b714b6bec89e36999a883397eae45f73

memory/1900-17785-0x0000000035000000-0x0000000035162000-memory.dmp

memory/1900-20288-0x0000000035000000-0x0000000035162000-memory.dmp

memory/1900-22424-0x0000000035000000-0x0000000035162000-memory.dmp

memory/1900-24548-0x0000000035000000-0x0000000035162000-memory.dmp

memory/1900-28392-0x0000000035000000-0x0000000035162000-memory.dmp

memory/1772-30287-0x0000000035000000-0x0000000035162000-memory.dmp

memory/1900-31112-0x0000000035000000-0x0000000035162000-memory.dmp

memory/1148-31113-0x0000000035000000-0x0000000035162000-memory.dmp

memory/1772-31622-0x0000000035000000-0x0000000035162000-memory.dmp

memory/1900-32158-0x0000000035000000-0x0000000035162000-memory.dmp

memory/1148-32159-0x0000000035000000-0x0000000035162000-memory.dmp